CVE-2026-101860
RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 29, 2026
- Updated
- Sep 29, 2026
- Reserved
- Sep 28, 2026
Description
A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 3.0 | 8.8 High | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 2.0 | 9.0 High | AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
raspap-webguiRaspAP |
|
References
- VDB-411094 | RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges managementvdb-entrytechnical-description
- VDB-411094 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-101860 | CVE Analysis and Reportthird-party-advisory
- Submit #930259 | RaspAP RaspAP WebGUI 3.2.6-3.5.5 Local Privilege Escalation / Insecure Sudo Configurationthird-party-advisory
- https://gist.github.com/simyat/10422042d6d5225b2beb87754de4b68cexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.