CVE-2026-82602

SeaCMS ass.php authorization

State: Published
Severity: 6.9 Medium
Published: Aug 31, 2026
Updated: Aug 31, 2026
Reserved: Aug 30, 2026

Description

A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-639 Authorization Bypass
CWE-285 Improper Authorization

Affected Products

Product	Versions
SeaCMSn/a	13.0Affected 13.1Affected 13.2Affected 13.3Affected 13.4Affected 13.5Affected 13.6Affected

References

VDB-397104 | SeaCMS ass.php authorizationvdb-entry
VDB-397104 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-82602 | CVE Analysis and Reportthird-party-advisory
Submit #892789 | SeaCMS 13.6 Information Disclosurethird-party-advisory
https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-011-ass-paywall-url-disclosure.mdexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.