CVE-2026-0021
published 2026-03-02CVE-2026-0021: In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to…
PriorityP345high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.10%
0.8th percentile
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| platform | packages_apps_settings | >= 14:0 < 14:2026-03-01 | 14:2026-03-01 |
| platform | packages_apps_settings | >= 15:0 < 15:2026-03-01 | 15:2026-03-01 |
| platform | packages_apps_settings | >= 16-qpr2-next:0 < 16-qpr2-next:2026-03-01 | 16-qpr2-next:2026-03-01 |
| platform | packages_apps_settings | >= 16-qpr2:0 < 16-qpr2:2026-03-01 | 16-qpr2:2026-03-01 |
| platform | packages_apps_settings | >= 16:0 < 16:2026-03-01 | 16:2026-03-01 |
CVSS provenance
nvdv3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q689-c7qh-hgv3: In hasInteractAcrossUsersFullPermission of AppInfoBase
ghsa_unreviewed·2026-03-02
CVE-2026-0021 [HIGH] CWE-441 GHSA-q689-c7qh-hgv3: In hasInteractAcrossUsersFullPermission of AppInfoBase
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
OSV
CVE-2026-0021: In hasInteractAcrossUsersFullPermission of AppInfoBase
osv·2026-03-01
CVE-2026-0021 CVE-2026-0021: In hasInteractAcrossUsersFullPermission of AppInfoBase
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-0021 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.4
CVE-2026-0021 [HIGH] CVE-2026-0021 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0021 :
NixOS vulnerability analysis and mitigation
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Source : NVD
## 8.4
Score
Published March 2, 2026
Severity HIGH
CNA Score 8.4
Affected Technologies
NixOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
android
Sources
NVD
Nix Severity HIGH No Fix Added at: Mar 04, 2026
## Get a CVE risk assessment
Get a prioritize
Bugzilla
CVE-2026-58340 moodle: CSRF and XSS in grade item idnumber editing [fedora-all]
bugzilla·2026-07-28
CVE-2026-58340 [MEDIUM] CVE-2026-58340 moodle: CSRF and XSS in grade item idnumber editing [fedora-all]
CVE-2026-58340 moodle: CSRF and XSS in grade item idnumber editing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MSA-26-0021: CSRF and XSS in grade item idnumber editing
Description: The grade item ID number editing functionality did not
include the necessary token to prevent a CSRF risk and also
lacked sufficient output sanitizing to prevent an XSS risk.
Issue summary: CSRF and XSS in grade item idnumber editing
Severity/Risk: Serious
Versions affected: 5.2, 5.1 to 5.1.4, 5.0 to 5.0.7, 4.5 to 4.5.11 and earlier
unsupported versions
Versions fixed: 5.2.1, 5.1.5, 5.0.8 and 4.5.12
Reported by: Paul Ho
Bugzilla
CVE-2026-58340 moodle: CSRF and XSS in grade item idnumber editing
bugzilla·2026-06-30
CVE-2026-58340 [MEDIUM] CVE-2026-58340 moodle: CSRF and XSS in grade item idnumber editing
CVE-2026-58340 moodle: CSRF and XSS in grade item idnumber editing
MSA-26-0021: CSRF and XSS in grade item idnumber editing
Description: The grade item ID number editing functionality did not
include the necessary token to prevent a CSRF risk and also
lacked sufficient output sanitizing to prevent an XSS risk.
Issue summary: CSRF and XSS in grade item idnumber editing
Severity/Risk: Serious
Versions affected: 5.2, 5.1 to 5.1.4, 5.0 to 5.0.7, 4.5 to 4.5.11 and earlier
unsupported versions
Versions fixed: 5.2.1, 5.1.5, 5.0.8 and 4.5.12
Reported by: Paul Holden
Issue no.: MDL-88542
2026-03-02
Published