CVE-2026-27899: Privilege Escalation in wg-portal

Successful exploitation of CVE-2026-27899 allows an attacker to elevate their privileges within the wg-portal system. This means a standard user could gain administrative access, potentially leading to complete control over the WireGuard portal configuration, user management, and network settings. An attacker could modify network rules, expose sensitive data, or even compromise the underlying infrastructure. The blast radius extends to any systems accessible through the compromised portal, making it a critical security concern.

1. Reserved2026-02-24
2. Published2026-03-10
3. Modified2026-03-23
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-27899 is to immediately upgrade wg-portal to version 2.1.3 or later. If an upgrade is not immediately feasible, consider restricting user self-update capabilities within the portal's configuration. Review user access controls and audit logs for any suspicious activity. While a direct detection signature is challenging, monitor user activity for unexpected privilege escalations or administrative actions performed by users who should not have those permissions.