PT-2026-30020 · Ajenti · Auth Users Plugin+1

Thien225409 · Published 2026-04-03 · Updated 2026-04-06 · CVE-2026-35175

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Ajenti versions prior to 2.2.15

Description A user authenticated with the auth users plugin could install a custom package even without superuser privileges.

Recommendations Upgrade to version 2.2.15.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-35175

GHSA-73JV-44C3-J5P2

Affected Products

Ajenti

Auth Users Plugin

References · 6

• https://github.com/ajenti/ajenti/security/advisories/GHSA-73jv-44c3-j5p2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35175 · Security Note
• https://osv.dev/vulnerability/GHSA-73jv-44c3-j5p2 · Vendor Advisory
• https://github.com/ajenti/ajenti/releases/tag/v2.2.15 · Note
• https://github.com/ajenti/ajenti · Note
• https://twitter.com/CVEnew/status/2041223942451478681 · Twitter Post