CVE-2026-33590 describes a vulnerability in Portainer Community Edition where incorrect default permissions allow authenticated non-admin users with endpoint access to escalate privileges. These insecure defaults enable such users to access the host filesystem and execute code with root-equivalent privileges on the host system. The vulnerability stems from CWE-276, which concerns improper default permissions. No patch or official remediation level is currently documented, and no known exploits in the wild have been reported.

An attacker with valid non-administrative credentials and endpoint access can leverage this vulnerability to read sensitive files on the host or execute arbitrary code with root-equivalent privileges. This compromises the confidentiality, integrity, and availability of the host system, potentially leading to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict endpoint access to trusted users only and consider additional access controls or monitoring to limit exploitation potential.