WireGuard Portal is kwetsbaar voor Privilege Escalation via Gebruikers Zelf-Update naar Admin Niveau in github.com/h44z/wg-portal

Successful exploitation of CVE-2026-27899 allows an attacker to elevate their privileges within the wg-portal system. This means a standard user could gain administrative access, potentially leading to complete control over the WireGuard portal configuration, user management, and network settings. An attacker could modify network rules, expose sensitive data, or even compromise the underlying infrastructure. The blast radius extends to any systems accessible through the compromised portal, making it a critical security concern.

Organizations utilizing wg-portal for WireGuard network management are at risk, particularly those running versions prior to 2.1.3. Shared hosting environments where multiple users have access to the wg-portal instance are especially vulnerable, as a compromised user could potentially escalate privileges and impact other users on the same server.

• go: Inspect the wg-portal source code for the self-update functionality and any potential bypasses. • generic web: Monitor access logs for unusual user activity, particularly attempts to access administrative endpoints or modify user roles. • generic web: Check for unexpected changes in wg-portal configuration files that could indicate unauthorized privilege escalation.

1. 2026-03-10Disclosure

   disclosure

1. Gereserveerd2026-02-24
2. Gepubliceerd2026-03-10
3. Gewijzigd2026-03-23
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2026-27899 is to immediately upgrade wg-portal to version 2.1.3 or later. If an upgrade is not immediately feasible, consider restricting user self-update capabilities within the portal's configuration. Review user access controls and audit logs for any suspicious activity. While a direct detection signature is challenging, monitor user activity for unexpected privilege escalations or administrative actions performed by users who should not have those permissions.