GHSA-5rmx-256w-8mj9
High · 8.8CVSS
8.8
EPSS
—
Published
Feb 26, 2026
CISA due date
—
The record
WireGuard Portal is Vulnerable to Privilege Escalation via User Self-Update to Admin Level
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/h44z/wg-portal | 0 | 2.1.3 |
Related vulnerabilities
- CVE-2026-27899 WireGuard Portal (or wg-portal) is a web-based configuration portal for WireGuard server… Same vulnerability
- GO-2026-4398 WireGuard Portal v2 has Open Redirect Vulnerability in OAuth Authentication Flow in… Also affects github.com/h44z/wg-portal
- CVE-2026-114658 Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability… CWE-269
- CVE-2026-53614 util-linux is a random collection of Linux utilities. CWE-269
- CVE-2026-95837 containerd is an open-source container runtime. CWE-269
- CVE-2026-63349 AnyIO is a high level asynchronous concurrency and networking framework that works on top… CWE-269
- CVE-2026-92957 vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating… CWE-269
- CVE-2026-92958 vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. CWE-269