CVE-2026-59260 Details
Description
OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message command to a root smbd process, triggering command execution when SMB protocol messages are processed.
A vulnerability exists in OpenWrt's luci-app-samba4 due to an improper ACL configuration that grants read users the ability to execute the Samba daemon with controlled command-line arguments. This flaw allows authenticated users with delegated Samba read access to execute arbitrary commands as root by exploiting Samba's global options handling. The issue arises from the ACL treating the execution of the Samba daemon as a read-only operation, while in reality, it allows for significant command execution capabilities.
The recommended fix is to remove the execution permission for '/usr/sbin/smbd' from the luci-app-samba4 read ACL. If read-only access to Samba functionality is still needed, a narrow helper should be created that exposes fixed arguments without allowing caller-controlled options. Additionally, a regression test should be implemented to ensure that the ACL change is effective.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 12, 2026CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openwrt/luci/security/advisories/GHSA-vx64-mmp7-h36c | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/openwrt/luci/security/advisories/GHSA-vx64-mmp7-h36c | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/openwrt-luci-app-samba4-read-acl-remote-code-execution-via-smbd | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenWrt luci-app-samba4 | 26.158.66357~46cd823 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 12, 2026 | New CVE Received | [email protected] |