Which versions of luci-app-samba4 are affected by CVE-2026-59260?

A privilege escalation vulnerability in OpenWrt's LuCI web interface for Samba4 configuration allows authenticated administrators to gain root-level command execution on affected network devices,…

How to fix or mitigate CVE-2026-59260?

24 HOURS: Inventory all OpenWrt deployments with luci-app-samba4; restrict LuCI administrative interface access to authorized administrators only (network whitelist/VPN requirement); disable luci-app-samba4 on systems where Samba4 is not required. 7 DAYS: Implement network segmentation isolating affected devices from critical systems; enable and monitor SMB server logging for suspicious activity and unauthorized configuration changes. 30 DAYS: Monitor OpenWrt security advisories for patch availability; develop and test patch deployment procedures; evaluate long-term mitigation strategy (replacement systems or alternative file-sharing solutions if patch is not released within 60 days).

luci-app-samba4 CVE-2026-59260

Q: What is the CVSS score of CVE-2026-59260?

CVE-2026-59260 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-43233 HIGH

Improper Privilege Management (CWE-269)

2026-07-12 VulnCheck

GHSA-7pqv-wj3v-fcq3

Privilege Escalation Openwrt Luci

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable LuCI/ubus with low complexity but requires an authenticated delegated account (PR:L); execution as root yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 12:44 vuln.today

DescriptionCVE.org

OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message command to a root smbd process, triggering command execution when SMB protocol messages are processed.

AnalysisAI

Privilege escalation to root in OpenWrt's luci-app-samba4 (LuCI web interface) lets authenticated delegated users invoke the root-owned Samba daemon with attacker-controlled arguments. The package's 'read' ACL improperly grants file.exec permission on /usr/sbin/smbd, so a low-privileged operator can launch smbd with global options like 'message command' and achieve arbitrary command execution as root when SMB messages are processed. Reported by VulnCheck with a GHSA advisory published; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is LuCI, the OpenWrt web configuration framework, specifically the luci-app-samba4 management app. OpenWrt implements delegation through named ACL groups that map roles (like 'read') to permitted RPC/ubus operations and file actions. Here the 'read' ACL bundles a file.exec permission targeting /usr/sbin/smbd - the Samba 4 file-sharing daemon that normally runs as root. This is a textbook CWE-269 (Improper Privilege Management): a permission intended to be low-trust (read) is over-scoped to allow executing a privileged binary. Because smbd honors command-line/global configuration overrides such as 'message command' (which specifies a shell command executed on receipt of a Windows WinPopup/SMB message), controlling smbd's arguments is equivalent to controlling root shell execution.

RemediationAI

Apply the fix from the OpenWrt LuCI security advisory GHSA-vx64-mmp7-h36c (https://github.com/openwrt/luci/security/advisories/GHSA-vx64-mmp7-h36c); a patch is available per that vendor advisory, but a released, tagged fixed version is not independently confirmed in the available data, so update luci-app-samba4 to the corrected package once your feed publishes it (opkg/apk update then upgrade). As an immediate compensating control, remove or tighten the offending ACL by editing the samba4 ACL definition (under /usr/share/rpcd/acl.d/) to strip the file.exec grant on /usr/sbin/smbd from the 'read' role - trade-off: delegated read users may lose intended UI functions tied to that ACL. Additionally, revoke or avoid issuing delegated LuCI accounts to untrusted users and restrict access to the LuCI/ubus interface (bind management to a trusted VLAN or firewall the HTTP/HTTPS admin port) until patched; the side effect is reduced remote manageability for legitimate low-privilege operators.