CVE-2026-92761

HighCVSS 8.8/10Last modified Sep 23, 2026

Description

WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images by exploiting the get_instance gate that only checks grant existence.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
retspen	webvirtcloud	1b2da68b2800f94674dd96f4a986cde30ac88280

References

Timeline

Published: Sep 16, 2026
Last modified: Sep 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-927628.8Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side aut CVE-2026-927638.1Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint.CVE-2026-927644.3OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning th CVE-2026-927656.5ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vuln CVE-2026-927667.5The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in CVE-2026-927676.4The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all ve CVE-2026-927685.5A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, inclu CVE-2026-92778.1shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was back CVE-2026-927706.5Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project adminis CVE-2026-927716.5Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users CVE-2026-927727.1Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. A CVE-2026-927737.1Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organizati