Vulnerabilities

TI-2026-23173 CVE-2026-29002 · GHSA-6g6q-gcm9-395j

CouchCMS Privilege Escalation via f_k_levels_list Parameter

HIGH 72

CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00443 Published 2026-04-10 No fix listed CWE-639

TI-2025-41101 CVE-2025-67004 · GHSA-9w9h-4qfh-f6m6

Disputed An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin…

LOW 38

** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing directories back after back.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.06121 Published 2026-01-09 No fix listed CWE-22

TI-2025-13688 CVE-2025-15005 · GHSA-7v96-f75p-x544

CouchCMS reCAPTCHA config.example.php hard-coded key

MEDIUM 61

A security flaw has been discovered in CouchCMS up to 2.4.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00462 Published 2025-12-22 No fix listed CWE-320

TI-2023-22047 CVE-2023-41609 · GHSA-xgrq-27cp-45v2

An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows…

MEDIUM 60

An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0041 Published 2023-09-11 No fix listed CWE-601

Vulnerabilities

Filters

CouchCMS Privilege Escalation via f_k_levels_list Parameter

** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin…

CouchCMS reCAPTCHA config.example.php hard-coded key

An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows…

Disputed An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin…