What is the CVSS score of CVE-2026-27899?

CVE-2026-27899 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-27899?

Within 24 hours: Identify all WireGuard Portal instances and their versions; assess user account activity logs for suspicious privilege escalation attempts. Within 7 days: Apply vendor patch to version 2.1.3 or later on all affected systems; audit all user accounts for unauthorized admin status and revoke illegitimate permissions. Within 30 days: Conduct full access review of VPN infrastructure; implement enhanced logging and alerting for admin role changes; restrict authenticated user base if business requirements allow.

Wireguard CVE-2026-27899

HIGH

Improper Privilege Management (CWE-269)

2026-02-26 security-advisories@github.com

GHSA-5rmx-256w-8mj9

Docker Wireguard Wireguard Portal Suse

8.8

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as non-admin user
Delivery

Send PUT request to user profile endpoint
Exploit

Include IsAdmin true in JSON body
Execution

Server parses field into user model
Impact

User gains admin privileges after re-login

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	WireGuard Portal versions prior to 2.1.3 with authenticated user access. Attacker must have valid login credentials for any non-admin user account. No additional special configuration required beyond standard deployment.
Impact	CVSS 8.8 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation requires authentication.
Exploit ScenarioDerived	An attacker (requires authentication) could exploit this vulnerability to compromise the affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Privilege escalation in WireGuard Portal prior to version 2.1.3 allows authenticated non-admin users to gain full administrator access by modifying their own user profile with an IsAdmin flag set to true. The vulnerability exists because the server fails to properly validate and restrict the IsAdmin field during profile updates, allowing the privilege change to persist after re-authentication. Affected deployments require immediate patching to version 2.1.3 or later to prevent unauthorized administrative access.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 8.8

RemediationAI

A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.

Affected Packages

go github.com/h44z/wg-portal fix: 2.1.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in go

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Classified as CWE-269 (Improper Privilege Management). Affects Wireguard Portal. WireGuard Portal (or wg-portal) is a web-based configuration portal for WireGuard server management. Prior to version 2.1.3, any authenticated non-admin user can become a full administrator by sending a single PUT request to their own user profile endpoint with "IsAdmin": true in the JSON body. After logging out and back in, the session picks up admin privileges from the database. When a user updates their own profile, the server parses the full JSON body into the user model, including the `Is

Know when Wireguard gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE HIGH

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 02, 2026 - 18:52 nvd

Patch available

CVE Published

Feb 26, 2026 - 02:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

WireGuard Portal (or wg-portal) is a web-based configuration portal for WireGuard server management. Prior to version 2.1.3, any authenticated non-admin user can become a full administrator by sending a single PUT request to their own user profile endpoint with "IsAdmin": true in the JSON body. After logging out and back in, the session picks up admin privileges from the database. When a user updates their own profile, the server parses the full JSON body into the user model, including the IsAdmin boolean field. A function responsible for preserving calculated or protected attributes pins certain fields to their database values (such as base model data, linked peer count, and authentication data), but it does not do this for IsAdmin. As a result, whatever value the client sends for IsAdmin is written directly to the database. After the exploit, the attacker has full admin access to the WireGuard VPN management portal. The problem was fixed in v2.1.3. The docker images for the tag 'latest' built from the master branch also include the fix.

Executive ViewAI

Why It Matters

WireGuard Portal deployments are vulnerable to privilege escalation, allowing any authenticated user to grant themselves full administrator access with a single request. This directly compromises administrative control and network security for any organization using affected versions, enabling unauthorized access to VPN infrastructure management.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not possible: restrict network access to the WireGuard Portal management interface using firewall rules or WAF; disable self-service user profile modification endpoints; implement request-level monitoring and alerting for IsAdmin parameter changes in PUT requests to user endpoints; conduct daily administrative account audits for unauthorized changes.

Threat Intelligence Overview

EPSS Score

0.1%

Top 78% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.