CVE-2020-36890
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalidate security-sensitive macros by manipulating user privilege levels.
Risk Assessment
The possibility of compromising administrator accounts and security mechanisms could lead to full system compromise.
Recommendation
It is recommended to restrict access to administrative functions and apply available security patches from the vendor.
Other vulnerabilities in Kentico Xperience
See all- CVE-2025-2747CriticalActively exploited
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects. This issue affects Xperience through 13.0.178.
- CVE-2025-2746CriticalActively exploited
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects. This issue affects Xperience through 13.0.172.
Original NVD description (English source)
An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalidate security-sensitive macros by manipulating user privilege levels.