CVE-2026-47366: Admin Privilege Escalation in ACP – CVSS 7.2 HIGH

Technical summary

CVE-2026-47366 stems from improper validation of access control permissions in the ACP. When an authenticated administrator attempts to modify permissions—either their own or those of other accounts—the system fails to verify that the target permissions do not exceed the requestor's authorization level. This represents a classic privilege escalation flaw under CWE-284 (Improper Access Control). The vulnerability requires administrative credentials to exploit but does not require user interaction and operates over the network, making it a systematic risk in environments where admin accounts exist or can be compromised.

Business impact

A single compromised or disgruntled administrator can unilaterally elevate their own privileges to near-total system control without detection through normal audit logs, which may only record the permission change itself. This breaks the principle of least privilege and eliminates a critical segregation-of-duties control. Organizations relying on role-based access controls to limit admin scope—such as read-only admins, domain-specific admins, or auditors—face the risk that those boundaries are meaningless. Downstream impact includes unauthorized data access, system modification, or compliance violations if privileged actions are attributed to a lower-privileged account.

Affected systems

The vulnerability affects the Administration Control Panel (ACP) component. No specific product names or versions are identified in the published advisory. Organizations should consult the vendor advisory to determine which products, versions, and deployment configurations contain this flaw. This may affect multiple products or editions if they share the same ACP codebase.

Exploitability

Exploitability is straightforward for any authenticated administrator. An attacker with valid admin credentials—obtained through compromise, insider threat, or credential theft—can navigate the ACP UI to modify permissions without special tools or user interaction. The attack surface is limited to authenticated administrators, but in environments with multiple admins, shared accounts, or service accounts with admin roles, the risk is amplified. The CVSS vector (PR:H) correctly reflects that high-level privileges are required, but once obtained, the escalation is trivial.

Remediation

Apply the vendor-supplied security patch that implements proper validation of permission assignments. The patch should enforce that an administrator cannot grant permissions equal to or greater than their own effective authorization level. Organizations should verify patch availability and applicability to their specific ACP deployment. Until patching, implement compensating controls: restrict admin panel access to a small, audited group; enable detailed logging and monitoring of permission changes; and conduct privilege audits to detect unauthorized elevation.

Patch guidance

Contact your ACP vendor for the latest security patch. Test patches in a non-production environment before deployment. After patching, conduct a privilege audit to identify any unauthorized permission escalations that may have occurred prior to remediation. Verify that the patched system now rejects permission-elevation attempts by administrators attempting to exceed their own authorization level.

Detection guidance

Monitor ACP logs for permission modification events, especially those initiated by administrator accounts. Flag instances where an admin modifies their own permissions or those of highly privileged accounts. Implement alerting on any permission change that grants capabilities not already present in the initiating admin's profile. Cross-reference permission audit logs with user access logs to identify privilege elevation that may not have been immediately visible in real-time monitoring.

Why prioritize this

This vulnerability scores HIGH (CVSS 7.2) due to the combination of high confidentiality, integrity, and availability impact, coupled with network-accessible exploitation by authenticated administrators. Although it requires valid admin credentials, the ease of exploitation and the severity of impact—undetected privilege escalation within the administrative layer—warrant rapid remediation in any environment where admin account compromise is a plausible threat model. Organizations with strict segregation of administrative duties or compliance requirements around least privilege should prioritize this above vulnerabilities requiring user interaction or greater technical sophistication.

Risk score, explained

The CVSS 3.0 score of 7.2 (HIGH) is calculated from the vector CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Network accessibility (AV:N) and low attack complexity (AC:L) reflect that any authenticated admin can exploit this over the network without special conditions. The high privilege requirement (PR:H) appropriately gates the attack to administrators, but the complete impact on confidentiality, integrity, and availability (C:H/I:H/A:H) reflects that an escalated admin can read, modify, and disrupt the system. The unchanged scope (S:U) indicates the impact is confined to the affected application, not the broader system or other applications.

Frequently asked questions