Is there a public PoC exploit available for CVE-2026-12673?

Yes, a public proof-of-concept exploit is available for CVE-2026-12673. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-12673?

Yes, a patch is available for CVE-2026-12673. Update the affected software to the latest version immediately.

LiquidFiles CVE-2026-12673

Q: What is the CVSS score of CVE-2026-12673?

CVE-2026-12673 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38111 MEDIUM

Improper Authorization (CWE-285)

2026-06-20 PRJBLK

GHSA-pmp7-7j9c-794v

Authentication Bypass Privilege Escalation Liquidfiles

5.9

CVSS 4.0 · Vendor: PRJBLK

Severity by source

Vendor (PRJBLK) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

PR:H for required secondary domain Admin credentials; S:C because escalation crosses from domain-scoped to system-wide authorization, with full C/I/A Sysadmin impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (PRJBLK).

CVSS VectorVendor: PRJBLK

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:15 vuln.today

Patch available

Jun 20, 2026 - 15:01 EUVD

DescriptionCVE.org

Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privilege escalation from an Admin in a secondary domain to a Sysadmin by modifying a group in their managed secondary (non-default) group.

AnalysisAI

Privilege escalation in LiquidFiles before 4.2.12 allows an authenticated Admin of a secondary (non-default) domain to elevate to full Sysadmin access by manipulating group settings within their managed secondary domain group. This broken access control flaw (CWE-285) collapses the authorization boundary between domain-scoped Admin and system-wide Sysadmin roles, granting an attacker complete platform control. No public exploitation has been confirmed in CISA KEV, but a public proof-of-concept is available from Project Black (PRJBLK), meaningfully elevating real-world risk above what the 5.9 CVSS score alone suggests.

Technical ContextAI

LiquidFiles is a secure file-sharing platform that supports multi-domain deployments, where secondary (non-default) domains can be administered by domain-scoped Admin accounts with privileges intentionally separated from the global Sysadmin role. The root cause is CWE-285 (Improper Authorization): the group management functionality in secondary domains fails to enforce the authorization boundary, allowing a secondary domain Admin to craft or modify group parameters that trigger a privilege elevation to Sysadmin. The affected product is identified by CPE cpe:2.3:a:liquidfiles:liquidfiles:*:*:*:*:*:*:*:*, covering all versions below 4.2.12. The CVSS 4.0 attack requirement metric AT:P confirms a specific precondition - a multi-domain configuration - must be present for exploitation to be possible.

RemediationAI

Upgrade to LiquidFiles 4.2.12 or later, which is the vendor-released patch confirmed by the release notes at https://docs.liquidfiles.com/release_notes/version_4-2-x.html. If immediate upgrade is not possible, audit all secondary domain Admin accounts and review recent group membership changes for signs of unauthorized privilege escalation. As a compensating control, restrict secondary domain Admin accounts to the minimum required set - removing the role from any untrusted or unnecessary accounts eliminates the attack surface entirely, though this limits legitimate delegation. Alternatively, temporarily consolidating all administration under the primary Sysadmin account (and disabling secondary domain admin delegation) removes the exploitable privilege boundary until patching is complete, at the cost of administrative convenience in multi-domain setups.