---
id: CVE-2026-72840
title: >-
  OpenWrt LuCI contains an overly permissive ACL definition in
  luci-mod-system-mounts that grants write access to /etc/crontabs/root to users
  intended only for mount configuration
summary: >-
  OpenWrt LuCI contains an overly permissive ACL definition in
  luci-mod-system-mounts that grants write access to /etc/crontabs/root to users
  intended only for mount configuration. Authenticated users with only the
  mount-configuration ACL …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-266
vendor: openwrt
product: luci
affected:
  - luci (all versions)
published: '2026-08-13'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:35:08.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72840'
references:
  - url: 'https://github.com/openwrt/luci/security/advisories/GHSA-v5f9-62c7-cw29'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/openwrt-luci-luci-mod-system-mounts-acl-root-rce-via-crontab-write
    label: disclosure@vulncheck.com
  - url: 'https://github.com/openwrt/luci/security/advisories/GHSA-v5f9-62c7-cw29'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-14T19:03:28.552422Z'
ingestedAt: '2026-09-10T20:33:18.296Z'
epss: 0.00442
epssPercentile: 0.35806
---

## Overview

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.