CVE-2026-101860 affects RaspAP raspap-webgui versions up to 3.5.5. The vulnerability resides in the PluginInstaller::addSudoers function within src/RaspAP/Plugins/PluginInstaller.php, specifically in the sudo configuration component. An attacker can manipulate this function to cause improper privilege management, potentially escalating privileges remotely. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, no user interaction required, and impacts confidentiality, integrity, and availability. Exploit code has been publicly released. The vendor was contacted but did not provide any response or patch.

Successful exploitation allows remote attackers to improperly manage privileges, likely leading to privilege escalation with high impact on confidentiality, integrity, and availability of the affected system. This can compromise the entire system running the vulnerable RaspAP raspap-webgui component.

No official patch or remediation is currently available as the vendor has not responded to the disclosure. Users should monitor the vendor's channels for updates. Until a fix is released, consider restricting network access to the affected service and applying compensating controls to limit exposure.