CVE WatchJul 24, 2026

CVE-2026-16743

A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validati

CVSS

5.5

Medium

EPSS

—

KEV

—

Exploit Today

0-100

Published: Jul 24, 2026 · Last modified: Jul 24, 2026 · CWE-269

EPSS · 30d

Not enough EPSS history yet.

Technical description

A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the accounts-daemon process.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-12502—

—

——0Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.22h CVE-2026-10610—

—

——0Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user.1d CVE-2026-7483—

2.6%

——1Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user.1d CVE-2026-129817.5 HIG

7.4%

——2The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.17h CVE-2026-124977.5 HIG

3.1%

——1The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.18 does not consistently enforce the role restriction configured on its front-end registration role-selection field. The set of roles offered to the visitor and the set of roles the registration handler accepts are derived by two different parsers, and for some valid ways of configuring the offered roles the handler ignores the restriction and falls back to accepting any non-administrator role. Combined with the absence of a nonce on the public registration handler, this allows an unauthenticated visitor to register an account with a higher role, such as Editor or Author, than the form was configured to offer.17h CVE-2026-127368.0 HIG

26.2%

——8The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options (for example setting default_role to administrator and users_can_register to 1, or disabling security plugins via active_plugins).17h