CVE-2026-4514: PbootCMS Backend UserController.php access control
A flaw has been found in PbootCMS up to 3.2.12. Affected by this issue is some unknown functionality of the file apps/admin/controller/system/UserController.php of the component Backend. Executing a manipulation of the argument Field can lead to improper access controls. The attack may be performed from remote. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4514?
CVE-2026-4514 has been classified with a high severity due to potential unauthorized access to user management functionalities in PbootCMS.
How do I fix CVE-2026-4514?
To fix CVE-2026-4514, it is recommended to upgrade PbootCMS to version 3.2.13 or later, which addresses this vulnerability.
What are the potential impacts of CVE-2026-4514?
If exploited, CVE-2026-4514 could allow an attacker to manipulate user permissions and gain elevated access within the backend system.
Which versions of PbootCMS are affected by CVE-2026-4514?
CVE-2026-4514 affects all versions of PbootCMS up to and including 3.2.12.
Is there a workaround for CVE-2026-4514?
As a temporary workaround for CVE-2026-4514, restrict access to the affected UserController.php file until an upgrade can be performed.