CVE-2026-47366

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the administrative interface.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Jun 12, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-473679.9A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID EnterpCVE-2026-473688.6A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtaiCVE-2026-473699.9A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain deCVE-2026-47377.3Use After Free vulnerability in No-Chicken Echo-Mate (‎SDK/rv1106-sdk/sysdrv/source/kernel/mm modules). This vulnerability is associated witCVE-2026-473709.9A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain deCVE-2026-473729.1Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, CVE-2026-473737.5Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. DiscreCVE-2026-473756.0NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, an authenticated user with columnAdd permission on a PostgresCVE-2026-473765.1NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into CVE-2026-473775.1NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the client-side hashRedirect plugin called window.location.reCVE-2026-473786.9NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns thatCVE-2026-473796.9NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared-view password check fell back to strict-equality (