CVE-2026-12673: LiquidFiles Privilege Escalation Flaw

CVE-2026-12673 Overview

CVE-2026-12673 is a broken access control vulnerability in LiquidFiles secure file transfer appliance versions before 4.2.12. The flaw allows an Admin user scoped to a secondary (non-default) domain to escalate privileges to Sysadmin by modifying a group within their managed secondary group. The issue maps to CWE-285: Improper Authorization and originates in the group management workflow that fails to enforce domain boundaries on privilege assignments.

Critical Impact
A secondary-domain Admin can promote themselves or other users to Sysadmin, gaining full administrative control of the LiquidFiles appliance and access to all hosted file transfers.

Affected Products

LiquidFiles secure file transfer appliance versions prior to 4.2.12
Deployments using multi-domain configurations with secondary (non-default) domains
Tenants with delegated Admin roles managing non-default groups

Discovery Timeline

2026-06-20 - CVE-2026-12673 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-12673

Vulnerability Analysis

LiquidFiles supports a multi-domain deployment model where each domain has its own Admin role scoped to manage users and groups within that domain. The Sysadmin role sits above all domains and controls the appliance globally. The vulnerability stems from the group modification endpoint failing to validate whether a secondary-domain Admin is authorized to assign Sysadmin-level attributes to a group they manage.

Because group membership and role inheritance are coupled, modifying a managed secondary group with elevated role flags propagates Sysadmin privileges to its members. The vulnerability is authenticated and requires the attacker to already hold Admin rights in a non-default domain. See the Project Black privilege escalation write-up for technical details on the exploitation path.

Root Cause

The root cause is missing authorization checks on group attribute changes. The application trusts that any Admin who owns a group may modify all of its properties, including properties that bridge the domain-to-Sysadmin trust boundary. This is a classic broken access control pattern where role assignment logic does not re-evaluate the actor's privilege ceiling.

Attack Vector

Exploitation is network-based and requires high privileges (an existing secondary-domain Admin account) but no user interaction. The attacker authenticates to the LiquidFiles web console, navigates to a group under their administrative scope, and submits a modified group configuration that elevates the group's role to Sysadmin. Subsequent logins by members of that group, including the attacker, carry Sysadmin authority.

No public proof-of-concept code is available. Refer to the LiquidFiles 4.2.x release notes for the corresponding fix details.

Detection Methods for CVE-2026-12673

Indicators of Compromise

Unexpected appearance of Sysadmin role assignments on groups originally scoped to a secondary domain.
Audit log entries showing group modifications performed by secondary-domain Admins immediately followed by Sysadmin-level actions.
New or modified administrative accounts created outside the default domain shortly after a group edit event.

Detection Strategies

Review LiquidFiles audit logs for group update events that change role or privilege attributes, correlating actor domain with target group domain.
Alert on any login by a non-default domain user that performs Sysadmin-only operations such as appliance configuration or system settings changes.
Baseline the expected Sysadmin user set and detect deviations through periodic exports of administrative role membership.

Monitoring Recommendations

Forward LiquidFiles application and audit logs to a centralized SIEM and retain them for at least 90 days.
Monitor authentication events for accounts whose role changed within the last 24 hours and flag privilege transitions across domain boundaries.
Track configuration drift on the appliance by comparing administrative role inventories on a daily basis.

How to Mitigate CVE-2026-12673

Immediate Actions Required

Upgrade all LiquidFiles instances to version 4.2.12 or later as documented in the vendor release notes.
Audit all current Sysadmin accounts and remove any that cannot be tied to an authorized administrator.
Review recent group modification events in secondary domains and reverse any unauthorized role elevations.
Rotate credentials for accounts that held Admin rights in secondary domains during the exposure window.

Patch Information

LiquidFiles addressed CVE-2026-12673 in version 4.2.12. The fix enforces authorization checks on group role changes so that a secondary-domain Admin cannot assign privileges beyond their own scope. Patch details are published in the LiquidFiles 4.2.x release notes.

Workarounds

Restrict delegated Admin assignments in secondary domains until the patch is applied.
Consolidate group administration under Sysadmin-controlled accounts and remove Admin rights from secondary-domain users temporarily.
Place the LiquidFiles management interface behind network access controls that limit Admin console reachability to trusted operators.

bash

# Verify the installed LiquidFiles version meets the patched baseline
curl -sk https://liquidfiles.example.com/api/v3/version \
  -H "X-Auth-Token: $LF_SYSADMIN_TOKEN" | jq '.version'
# Expected output: "4.2.12" or later