High severity · published Sep 29, 2026
CVE-2026-101860
RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
raspap-webgui · RaspAP
3.5.0; 3.5.1; 3.5.2; 3.5.3; 3.5.4; 3.5.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101860
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101860
vdb-entry
https://vuldb.com/vuln/411094
signature
https://vuldb.com/vuln/411094/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-101860
third-party-advisory
https://vuldb.com/submit/930259
exploit
https://gist.github.com/simyat/10422042d6d5225b2beb87754de4b68c
More from raspap-webgui
9.8
CVE-2025-50428
In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script
9.8
CVE-2024-36622
In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script
8.8
CVE-2026-24788
RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability
6.3
CVE-2025-44163
RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php
5.4
CVE-2026-101859
RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection