CVE-2026-48581

HighCVSS 7.8/10Last modified Jul 24, 2026

Description

Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1220

Affected software

No affected versions have been published.

Timeline

Published
Jul 14, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-485829.6Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.CVE-2026-485837.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-485848.8Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a network.CVE-2026-485867.5Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. CVE-2026-485875.3An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leCVE-2026-485885.3An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache resCVE-2026-485895.4Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, iCVE-2026-48596.4The SP Blog Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'design' attribute of the `wpsbd_post_carouseCVE-2026-485902.1XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vulnerability is assocCVE-2026-485914.8Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescCVE-2026-485925.3Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker subsCVE-2026-485935.9Uncontrolled Resource Consumption vulnerability in oban-bg oban_web ('Elixir.Oban.Web.CronExpr' modules) allows memory exhaustion via unboun
CVE-2026-48581: High severity, CVSS 7.8 | Vulnix