CVE-2026-75520
Description
A flaw was found in Domoticz. Missing authorization checks allow low-privileged authenticated users to execute existing server scripts with attacker-controlled input. The application's device update command handler fails to validate user permissions before invoking Lua scripts and does not properly restrict script file paths. A remote authenticated attacker can exploit this issue by submitting a crafted web request, resulting in unauthorized script execution and potential data modification.
Statement
This vulnerability is rated as Moderate severity because exploitation requires an existing authenticated session with network reachability, and execution is strictly confined to pre-installed Lua scripts on the server rather than permitting arbitrary code execution. Domoticz is not included or supported in Red Hat Enterprise Linux, limiting exposure to Fedora community packages. Consequently, enterprise environments running supported Red Hat products are not affected by this flaw.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Read Application Data; Modify Application Data; Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
