CVE-2026-112239CWE-862CWE-915broken-access-control
CVE-2026-112239
published October 20, 2026
What it is
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
The record
Technical detail
- CVSS
- 7.2 · NONE
- CVSS v4.0
- 7.2 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
- EPSS
- 0.00350 · 27.4th percentile
- Weaknesses
- CWE-862 · Missing Authorization; CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
- Published
- 2026-10-20T14:17Z
References (1)
EPSS history
Timeline