CVE-2026-32300CWE-285CWE-639

Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information

High · published March 23, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
37.5
In the wild
Unconfirmed
What it is

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information. Versions 1.41.1 and 2.41.1 contain a patch.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00443 · 37.5th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-03-23T21:40Z
EPSS history
Timeline
  • 23 MAR 21:40Z
    Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information
    cvelistv5