CVE-2026-16337CWE-269privilege-escalation

CVE-2026-16337

published July 21, 2026

CVSS
9.4
EPSS
1%
Percentile
47.0
In the wild
Unconfirmed
What it is

Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote code execution via a crafted OSGi bundle upload whose BundleActivator executes arbitrary shell commands.

The record
Technical detail
CVSS
9.4 · NONE
CVSS v4.0
Not supplied
EPSS
0.00580 · 47.0th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-07-21T00:16Z
References (2)
https://dev.dotcms.com/docs/manage/access-and-security/security-and-privacy/known-security-issues?issueNumber=SI-76 · [email protected]https://github.com/dotCMS/core/pull/36344 · [email protected]
EPSS history
Timeline
  • 20 JUL 19:15Z
    Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a…
    cvelistv5