CVE-2026-90441

13th percentile - higher than 13% of all known CVEs

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.

The vulnerability allows authenticated low-privileged users to cause service crash and read sensitive files. It can lead to denial of service and data leakage.

Update wgagent to a patched version. Restrict administrative account privileges and implement additional authorization checks in the management API.