---
id: 3712
title: "[CVE-2026-12673] Liquidfiles Privilege Escalation"
cve: CVE-2026-12673
cvss: 5.9
severity: medium
source_domain: projectblack.io
source_url: "https://projectblack.io/blog/liquidfiles-privilege-escalation/"
published_at: "2026-06-20 12:31"
tags: ["access-control", "privilege-escalation", "web-security", "liquidfiles", "cve-2026-12673"]
phying_url: "https://phying.com/item/3712"
lang: en
---

# [CVE-2026-12673] Liquidfiles Privilege Escalation

## Summary

A secondary-domain admin in LiquidFiles can escalate to sysadmin (CVE-2026-12673) by tampering with group requests to set admin_level=5. The post walks through the exploitation and the vendor's fix.

## Intelligence Metadata

- **Sources:** projectblack.io
- **CVE:** CVE-2026-12673
- **CVSS:** 5.9
- **Published:** 2026-06-20 12:31
- **Original:** https://projectblack.io/blog/liquidfiles-privilege-escalation/
- **Phying News:** https://phying.com/item/3712