CVE-2026-79920

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin construct a pip package specification from unvalidated name and version fields, and the task worker invokes pip while running as root. A low-privileged user can therefore select or manipulate a package installed with root privileges and can install, remove, or upgrade plugins without administrative permission, resulting in root code execution and full host compromise. This issue is fixed in version 2.2.16.

• CWE-862

• https://github.com/ajenti/ajenti/commit/3a8cbee32df4c5033796f19af4210011163a6f6e
• https://github.com/ajenti/ajenti/commit/f07f02e0cdeeb3e528c1d5af28e27fd11623c49c
• https://github.com/ajenti/ajenti/releases/tag/v2.2.16
• https://github.com/ajenti/ajenti/security/advisories/GHSA-j8xf-5fw2-f99q

Published

Sep 21, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-79913Cloudreve is a self-hosted file management and sharing syste…6.5
• CVE-2026-79916MaxKB is an open-source AI assistant for enterprise. Prior t…9.1
• CVE-2026-79917MaxKB is an open-source AI assistant for enterprise. In 2.7.…6.5
• CVE-2026-79918MaxKB is an open-source AI assistant for enterprise. Prior t…6.3
• CVE-2026-79919MaxKB is an open-source AI assistant for enterprise. Prior t…6.3
• CVE-2026-7992Insufficient validation of untrusted input in UI in Google C…8.8
• CVE-2026-79921amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0,…8.9
• CVE-2026-7993Insufficient validation of untrusted input in Payments in Go…4.2
• CVE-2026-79938Dell PowerProtect Cyber Recovery, versions prior to 20.3, co…8.8
• CVE-2026-79939Dell PowerProtect Cyber Recovery, versions Prior to 20.3, co…7.8
• CVE-2026-7994Inappropriate implementation in Chromoting in Google Chrome …7.8
• CVE-2026-79940Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G v…5.9