CVE-2026-93504CWE-266CWE-284broken-access-control

CVE-2026-93504

Medium · published September 18, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
29.3
In the wild
Unconfirmed
What it is

A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The name of the patch is 05b4f9efeb79e9d72a693232334d7529687f896f. It is advisable to implement a patch to correct this issue.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00366 · 29.3th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-284 · Improper Access Control
Published
2026-09-18T18:19Z
References (7)
https://github.com/SveltyCMS/SveltyCMS/ · [email protected]https://github.com/SveltyCMS/SveltyCMS/commit/05b4f9efeb79e9d72a693232334d7529687f896f · [email protected]https://vuldb.com/cve/CVE-2026-93504 · [email protected]https://vuldb.com/submit/942849 · [email protected]https://vuldb.com/vuln/407421 · [email protected]https://vuldb.com/vuln/407421/cti · [email protected]https://vuldb.com/submit/942849 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 18 SEP 13:15Z
    SveltyCMS User Attribute Update Endpoint +server.ts access control
    cvelistv5