CVE-2026-27051: uxper Golo – Incorrect Privilege Assignment (Privilege Escalation)
CVE-2026-27051 is an Incorrect Privilege Assignment weakness (CWE-266) in uxper Golo, which the record says allows privilege escalation. The record gives a CVSS 3.1 base score of 9.8 from the CNA Patchstack and lists versions from n/a through 1.7.0, but it provides no structured list of fixed versions. Defenders should check their installations against the stated range and review the vendor advisory for an update.
Overview
CVE-2026-27051 describes an Incorrect Privilege Assignment weakness (CWE-266) in the uxper Golo product, which the record says allows privilege escalation. The Patchstack advisory is the reference linked in the record for this entry.
Impact
The CVSS 3.1 base score of 9.8 was provided by the CNA Patchstack. The vector indicates a network attack vector, low attack complexity, no privileges required, no user interaction, and high impact to confidentiality, integrity and availability. A privilege escalation flaw means a user could obtain rights beyond those intended, so the practical impact depends on how the product is deployed.
Affected products and versions
- Product named in the record: uxper Golo.
- Range stated in the record: from n/a through 1.7.0.
- The record does not provide a structured list of affected or fixed versions.
Exploitation status
The CISA KEV entry in the record is not listed. No confirmed exploitation appears in the sources consulted for this analysis.
Remediation and mitigation
- Identify whether any installation falls within the stated range and treat it as a priority.
- Check the vendor and CNA advisory for an updated release, since the record does not name a fixed version.
- Until an update is applied, reduce exposure by reviewing accounts with elevated roles and limiting who can change role or permission assignments.
- Restrict access to administrative interfaces where feasible.
Detection guidance
- Review logs for unexpected changes to user roles or account permissions.
- Audit recently created or modified accounts that hold administrative rights.
- Monitor for administrative actions performed by accounts that should have low privileges.
Limitations of the available information
The record has no fixed version, no structured affected-version list, no CWE name, and no technical detail beyond the description. The record status is Deferred. The EPSS probability of 0.00483 is a statistical estimate of exploitation likelihood and is not evidence of exploitation.
Frequently asked questions
What is CVE-2026-27051?
It is an Incorrect Privilege Assignment weakness (CWE-266) in uxper Golo that the record says allows privilege escalation.
Which versions are stated as affected?
The record states a range from n/a through 1.7.0. It does not provide a structured list of affected or fixed versions.
Is this vulnerability known to be exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.