CVE-2026-67548

A non-administrator could change the agent host’s settings and updates

taOS maintainers · taOS system settings and updates

First documented disclosure · Review checkpoint

Summary

The system settings interface lacked a required administrator check. Users could read or alter configuration and disrupt availability through update operations.

Severity and exploitation evidence

High · 8.3/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The system settings interface lacked a required administrator check.

Conditions required

The caller had an authenticated non-administrative account.

Potential impact

Users could read or alter configuration and disrupt availability through update operations.

Affected versions and configurations

Before 1.0.0-beta.25.

Fix and mitigation status

1.0.0-beta.25.

Practical next steps

Upgrade and verify that invited accounts cannot administer the host.

Operating lesson

Check the authority granted to the affected component against the operation a user expects.

Evidence and limits

The public disclosure was on 2026-07-04. The CVE record was published on 2026-11-11.

Sources