An issue in the luci-mod-rpc package in OpenWRT Luci LTS allows for privilege escalation from an admin account to root via the JSON-RPC-API, which is exposed by the luci-mod-rpc package
https://github.com/VitoCrl/vulnerability_research/tree/main/CVE-2024-51240