{"id":"CVE-2026-72840","title":"OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration","summary":"OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL …","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-266"],"vendor":"openwrt","product":"luci","affected":["luci (all versions)"],"published":"2026-08-13","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:35:08.537","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72840","references":[{"url":"https://github.com/openwrt/luci/security/advisories/GHSA-v5f9-62c7-cw29","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openwrt-luci-luci-mod-system-mounts-acl-root-rce-via-crontab-write","label":"disclosure@vulncheck.com"},{"url":"https://github.com/openwrt/luci/security/advisories/GHSA-v5f9-62c7-cw29","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-08-14T19:03:28.552422Z"},"ingestedAt":"2026-09-10T20:33:18.296Z","epss":0.00442,"epssPercentile":0.35711,"slug":"CVE-2026-72840","body":"## Overview\n\nOpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":60,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}