CVE-2026-12673
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability allowing privilege escalation from an Admin in a secondary domain to a Sysadmin by modifying a group in their managed secondary group.
Risk Assessment
Organizations may be exposed to unauthorized access to resources and data, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade to Liquidfiles version 4.2.12 or later to mitigate this security vulnerability.
Other vulnerabilities in Liquidfiles
See all- CVE-2026-36163Medium
An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file.
- CVE-2026-36162Medium
An authenticated stored XSS vulnerability was found in LiquidFiles v4.2.7 in the Upload File Shares API. An attacker can inject malicious JavaScript or HTML into the Name parameter, which will be executed in other users' browsers.
Original NVD description (English source)
Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privilege escalation from an Admin in a secondary domain to a Sysadmin by modifying a group in their managed secondary (non-default) group.