CVE-2026-35175

HIGH
2026-04-03 https://github.com/ajenti/ajenti GHSA-73jv-44c3-j5p2
7.2
CVSS 4.0
Share

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch Released
Apr 03, 2026 - 08:30 nvd
Patch available
Analysis Generated
Apr 03, 2026 - 04:00 vuln.today
CVE Published
Apr 03, 2026 - 03:57 nvd
HIGH 7.2

Tags

Authentication Bypass

Description

### Impact An authenticated user (using the `auth_users` plugin authentication method) could install a custom package even if this user is not superuser. ### Patches This is fixed in the version 2.2.15. Users should upgrade to this version as soon as possible.

Analysis

Privilege escalation in Ajenti panel allows authenticated non-superuser accounts to install arbitrary Python packages, bypassing role-based access controls. Affects installations using the auth_users plugin authentication method. …

Sign in for full analysis, threat intelligence, and remediation guidance.

Remediation

Within 24 hours: identify all Ajenti installations and confirm which use the auth_users plugin and are running versions prior to 2.2.15. Within 7 days: upgrade all affected Ajenti deployments to version 2.2.15 or later; test in a non-production environment first. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: +0.1
CVSS: +36
POC: 0

Share

CVE-2026-35175 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy