Read the docs
TI-2026-11469 Aliases CVE-2026-13544GHSA-fgv8-397h-qgqf

Feehi CMS API users access control

Priority MEDIUM 57CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation, Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266 and CWE-284.

Summary

A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue is some unknown functionality of the file /api/users of the component API. This manipulation causes improper access controls. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00374 31st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FeehiCMS2.1.0; 2.1.1—No fix listedCNA
  • CMS VendorFeehi Affected 2.1.0; 2.1.1 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:feehi:cms:*:*:*:*:*:*:*:*——Feehi
  • cpe:2.3:a:feehi:cms:*:*:*:*:*:*:*:* Versions — — ·Feehi

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-13544
  2. 2026-10-03 Alias added: GHSA-fgv8-397h-qgqf

References

Exploit 1

Other 1

  • TI-2026-11471 Feehi CMS REST API Endpoint articles missing authentication CVSS 4.0MEDIUM 6.9
  • TI-2025-40416 FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad… CVSS 3.1MEDIUM 6.5
  • TI-2025-13939 FeehiCMS TimThumb timthumb.php server-side request forgery CVSS 4.0MEDIUM 6.9
  • TI-2020-18805 Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run… CVSS 3.1MEDIUM 6.1
  • TI-2025-39351 FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are… CVSS 3.1MEDIUM 6.5
  • TI-2025-39349 Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the… CVSS 3.1MEDIUM 6.1
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences