CVE Record
[ HIGH ]CVE-2026-72840
OpenWrt LuCI Mount App ACL Misconfiguration Grants Root Cron Write
luci-mod-system-mounts ACL grants /etc/crontabs/root write access to mount-config users, enabling cron injection executed as root within one minute. CVSS 8.8 high.
- Vendor
- OpenWrt
- Product
- LuCI (luci-mod-system-mounts)
- CVSS
- 8.8
- EPSS (exploit probability)
- 0.3%
- Status
- patched
- Published
luci-mod-system-mounts in OpenWrt’s LuCI interface defines an overly permissive ACL that grants write access to /etc/crontabs/root to users intended only for mount configuration. Any authenticated user in that ACL group can append arbitrary cron entries via ubus file.write. The default busybox crond daemon on OpenWrt executes those entries as root within one minute.
Affected: OpenWrt installations with luci-mod-system-mounts and users in the mount-configuration ACL group
Patch: Fix tracked in the upstream OpenWrt LuCI repository.
Source: GHSA-v5f9-62c7-cw29
