CVE-2026-93504: SveltyCMS User Attribute Update Endpoint +server.ts access control
A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The name of the patch is 05b4f9efeb79e9d72a693232334d7529687f896f. It is advisable to implement a patch to correct this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SveltyCMSto a version that resolves this vulnerability.Fixed in 0.0.6Patch 05b4f9efeb79e9d72a693232334d7529687f896f - Compensating control
Because the issue involves improper access controls in the SveltyCMS User Attribute Update Endpoint (+server.ts in src/routes/api/[...path]/+server.ts) and can be launched remotely, restrict access to the User Attribute Update Endpoint to trusted clients (e.g., via network firewall/ACL/WAF allowlists) until the patch is applied.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable and requires low privileges. No user interaction is required.
What security impact can exploitation have?
Successful exploitation can affect confidentiality, integrity, and availability, each at a low impact level. The reported weakness is improper access control in the user attribute update endpoint.
Which release is known to be affected?
SveltyCMS 0.0.6 is identified as affected. The provided data does not establish whether earlier or later releases are affected.
What should teams do to remediate the issue?
Implement the patch identified as 05b4f9efeb79e9d72a693232334d7529687f896f. The available information does not provide a workaround if patching cannot be performed immediately.