Webmin: Privilege escalation via group module assignment in acl/save_group.cgi
Summary
Webmin through version 2.670 contains a privilege escalation flaw in acl/save_group.cgi. A delegated administrator with access to the Webmin Users module can submit arbitrary module lists in the mod parameter and grant themselves groups with powerful modules such as Command Shell. An attacker with these privileges can thereby execute commands as root. The attacker must already hold a delegated administrator account, so the risk is mainly internal or from a compromised admin account.
Affected
- Webmin through 2.670
- Default configuration: unaffected (per the CNA record)
Fixed in
- Unknown. No vendor advisory or fixed version naming this CVE was found.
- A fix commit (be54ba38c3b86a3647a62327e1de81d5d0db098a) exists in the Webmin GitHub repository, but the release containing it has not been confirmed.
Workaround
- Unknown. No vendor workaround is published.
- Restrict delegated administrator rights and review accounts with Webmin Users module access.
Exploitation
- Exploited in the wild: unknown.
- Public proof of concept: unknown.
- Attack requires high privileges (PR:H) and no user interaction. CVSS 4.0 base score: 8.6 (High).
Our recommendation
- Inventory all Webmin instances and versions.
- Review delegated administrator accounts, group memberships and groups containing Command Shell or similar modules, and remove what is not needed.
- Restrict Webmin access to management networks or VPN, and do not expose it on public interfaces.
- Monitor for unexpected group or membership changes in Webmin configuration.
- Upgrade to a fixed Webmin release as soon as the vendor confirms one; re-check the vendor advisory and NVD in a few days.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linked GitHub source acl/save_group.cgi (2.670) github.com
- Fix commit be54ba38 (save_group.cgi module validation) github.com
- Commit c861e308 (Webmin) github.com
- VulnCheck advisory: Webmin through 2.670 privilege escalation www.vulncheck.com
- OffSeq Radar: CVE-2026-126780 radar.offseq.com
- Webmin security page webmin.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:26.
Original description (NVD)
Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access can create or edit groups holding modules like Command Shell and assign themselves membership to execute commands as root.
NVD references (4)
- https://github.com/webmin/webmin/blob/2.670/acl/save_group.cgi#L83
- https://github.com/webmin/webmin/commit/be54ba38c3b86a3647a62327e1de81d5d0db098a
- https://github.com/webmin/webmin/commit/c861e308f4ee4cff1795ccc7621fc75623e1bb90
- https://www.vulncheck.com/advisories/webmin-through-2.670-privilege-escalation-via-acl-save-group-cgi
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.