CVE-2026-28648

0th percentile - higher than 0% of all known CVEs

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

A local attacker can gain access to functions or data they should not have permissions for, potentially leading to privilege escalation.

Update the system to a version containing the fix or implement additional permission verification mechanisms in the Settings module.