CVE-2026-13544
Feehi CMS API users access control
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jun 29, 2026
- Updated
- Jun 29, 2026
- Reserved
- Jun 28, 2026
Description
A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue is some unknown functionality of the file /api/users of the component API. This manipulation causes improper access controls. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
CMSFeehi |
|
References
- VDB-374552 | Feehi CMS API users access controlvdb-entry
- VDB-374552 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-13544 | CVE Analysis and Reportthird-party-advisory
- Submit #842582 | liufee cms 2.1.1 Information Disclosurethird-party-advisory
- Submit #842595 | liufee cms 2.1.1 Improper Privilege Management (Duplicate)third-party-advisory
- Submit #842602 | liufee cms 2.1.1 Authorization Bypass (Duplicate)third-party-advisory
- https://github.com/liufee/cms/issues/88issue-tracking
- https://github.com/liufee/cms/issues/89exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.