What is CVE-2026-72840?

CVE-2026-72840 is a high-severity vulnerability in Openwrt Luci, classified under Incorrect Privilege Assignment. CVSS score: 8.8/10. Published 2026-08-13.

How severe is CVE-2026-72840?

High severity. CVSS v3 base score is 8.8 out of 10.

Privilege escalation in Openwrt Luci

CVE-2026-72840

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Openwrt Luci

Weakness classification (CWE)

CWE-266 — Incorrect Privilege Assignment

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-72840?: CVE-2026-72840 is a high-severity vulnerability in Openwrt Luci, classified under Incorrect Privilege Assignment. CVSS score: 8.8/10. Published 2026-08-13.
How severe is CVE-2026-72840?: High severity. CVSS v3 base score is 8.8 out of 10.