Tóm tắt nhanh
- CVE-2026-27198 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng getformwork/formwork, formwork (formwork project).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.46%, cao hơn 39.9% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 2.3.4 hoặc mới hơn.
Mô tả
Summary
The application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has sufficient privileges to assign highly privileged roles such as admin. As a result, an authenticated user with the editor role can create a new account with administrative privileges, leading to full administrative access and complete compromise of the CMS.
Impact
Successful exploitation allows an attacker to:
- Gain full administrative control over the CMS.
- Access all site data and user information.
- Modify system configuration and security settings.
- Create, modify, or delete any user account, including legitimate administrators.
Patches
Formwork 2.3.4 properly assigns roles on user creation.
Mô tả của NVD
Formwork is a flat file-based Content Management System (CMS). In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has sufficient privileges to assign highly privileged roles such as admin. As a result, an authenticated user with the editor role can create a new account with administrative privileges, leading to full administrative access and complete compromise of the CMS. This issue has been fixed in version 2.3.4.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí