CVE-2026-86271: FluentCMS PermissionManager.cs GetAccessible authorization
A vulnerability was found in FluentCMS up to 0.0.5. This affects the function GetAccessible of the file src/Backend/FluentCMS.Services/Permissions/PermissionManager.cs. Performing a manipulation results in missing authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs high privileges, but the attack can be initiated remotely and does not require user interaction. The affected authorization logic may allow a privileged remote user to bypass intended access checks.
Which FluentCMS versions are affected?
FluentCMS versions up to 0.0.5 are identified as affected. No fixed version is provided in the available information.
Is public exploit code available?
Yes. The exploit has been made public and could be used, which increases the likelihood of exploitation where an attacker has the required privileges.
What should teams do if no vendor response or patch is available?
Review and restrict access for high-privilege FluentCMS accounts, since exploitation requires high privileges and targets authorization behavior. Monitor privileged remote activity and access to functionality governed by the affected permission-management code.