CVE-2026-120844 is a critical Incorrect Privilege Assignment vulnerability in the miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin, affecting versions up to 7.1.3. This flaw allows privilege escalation, potentially granting attackers unauthorized high-level access. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.