CVE-2026-72840: OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-13 · updated 2026-09-30
Weakness: CWE-266

Description

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.

Affected products

openwrt luci: through 24.10.8; from 25.12.0 through 25.12.5

References

https://github.com/openwrt/luci/security/advisories/GHSA-v5f9-62c7-cw29
https://www.vulncheck.com/advisories/openwrt-luci-luci-mod-system-mounts-acl-root-rce-via-crontab-write
https://github.com/openwrt/luci/security/advisories/GHSA-v5f9-62c7-cw29

Get alerted when CVE-2026-72840 or the next vulnerability affects your stack