Insufficient Input Validation in ABR Affects Admin by Request Software
CVE-2026-78237

7.8HIGH

Key Information:

Vendor

Admin By Request (abr)

Status
Admin By Request (abr)
Vendor
CVE Published:
26 August 2026

What is CVE-2026-78237?

The Admin by Request (ABR) software exhibits a security flaw due to insufficient input validation. This vulnerability allows a low-privileged user to execute an injection attack on the sudoers file, thereby gaining persistent root access to the system, even after the ABR session has terminated. This poses a significant risk of unauthorized control over system functions, potentially allowing malicious actors to conduct further attacks or gain sensitive information.

Affected Version(s)

Admin By Request (ABR) 5.2.2 and below

References

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-20...
https://docs.adminbyrequest.com/security-advisories/abr-m...
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.