CVE-2026-12673 Privilege escalation in liquidfiles
An Admin in a secondary domain can escalate privileges to Sysadmin by modifying a group in their managed secondary group.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12673?
CVE-2026-12673 is a medium-severity vulnerability in liquidfiles, published on 20 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privilege escalation from an Admin in a secondary domain to a Sysadmin by modifying a group in their managed secondary (non-default) group.
Weakness: CWE-285
Which versions are affected by CVE-2026-12673?
How do I fix CVE-2026-12673?
No fix has been published for CVE-2026-12673 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-12673 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-12673 exists.
Sources
Also known as GHSA-pmp7-7j9c-794v.