CVE-2026-0026
published 2026-03-02CVE-2026-0026: In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due to a logic error in the code. This…
PriorityP341high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.10%
0.7th percentile
In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| platform | frameworks_base | >= 14:0 < 14:2026-03-01 | 14:2026-03-01 |
| platform | frameworks_base | >= 16-qpr2-next:0 < 16-qpr2-next:2026-03-01 | 16-qpr2-next:2026-03-01 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-445j-4jwp-v85f: In removePermission of PermissionManagerServiceImpl
ghsa_unreviewed·2026-03-02
CVE-2026-0026 [HIGH] CWE-862 GHSA-445j-4jwp-v85f: In removePermission of PermissionManagerServiceImpl
In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
OSV
CVE-2026-0026: In removePermission of PermissionManagerServiceImpl
osv·2026-03-01
CVE-2026-0026 CVE-2026-0026: In removePermission of PermissionManagerServiceImpl
In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-0026 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.8
CVE-2026-0026 [HIGH] CVE-2026-0026 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0026 :
NixOS vulnerability analysis and mitigation
In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Source : NVD
## 7.8
Score
Published March 2, 2026
Severity HIGH
CNA Score 7.8
Affected Technologies
NixOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
android
Sources
NVD
Nix Severity HIGH No Fix Added at: Mar 04, 2026
## Get a CVE risk assessment
Get a
Bugzilla
CVE-2026-58345 moodle: Missing capability check in Assignment marker allocation [fedora-all]
bugzilla·2026-07-28
CVE-2026-58345 [MEDIUM] CVE-2026-58345 moodle: Missing capability check in Assignment marker allocation [fedora-all]
CVE-2026-58345 moodle: Missing capability check in Assignment marker allocation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MSA-26-0026: Missing capability check in Assignment marker allocation
Description: Insufficient capability checks in the Assignment module's
marker allocation functionality allowed users without the
required capability to allocate markers to submissions.
Issue summary: Missing capability check in Assignment marker allocation
Severity/Risk: Serious
Versions affected: 5.2, 5.1 to 5.1.4, 5.0 to 5.0.7, 4.5 to 4.5.11 and earlier
unsupported versions
Versions fixed: 5.2.1, 5.1.5, 5
Bugzilla
CVE-2026-58345 moodle: Missing capability check in Assignment marker allocation
bugzilla·2026-06-30
CVE-2026-58345 [MEDIUM] CVE-2026-58345 moodle: Missing capability check in Assignment marker allocation
CVE-2026-58345 moodle: Missing capability check in Assignment marker allocation
MSA-26-0026: Missing capability check in Assignment marker allocation
Description: Insufficient capability checks in the Assignment module's
marker allocation functionality allowed users without the
required capability to allocate markers to submissions.
Issue summary: Missing capability check in Assignment marker allocation
Severity/Risk: Serious
Versions affected: 5.2, 5.1 to 5.1.4, 5.0 to 5.0.7, 4.5 to 4.5.11 and earlier
unsupported versions
Versions fixed: 5.2.1, 5.1.5, 5.0.8 and 4.5.12
Reported by: Paul Holden
Issue no.: MDL-88529
2026-03-02
Published