CVE-2026-29002

HighCVSS 7.2

Published: 10/04/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass authorization validation and gain full application control.

Risk Assessment

The risk is that an Admin-level user can unauthorizedly create a SuperAdmin account, leading to full compromise of the CouchCMS system and potential breach of data confidentiality, integrity, and availability.

Recommendation

It is recommended to immediately update CouchCMS to the latest version that fixes this vulnerability and implement server-side parameter validation to prevent privilege manipulation.

Other vulnerabilities in CouchCMS

CVE-2025-15005Low
A security flaw has been discovered in CouchCMS up to 2.4, affecting the file couch/config.example.php of the reCAPTCHA Handler component. Manipulation of the K_RECAPTCHA_SITE_KEY/K_RECAPTCHA_SECRET_KEY arguments results in use of a hard-coded cryptographic key. The attack can be launched remotely, is characterized by high complexity, and the exploit has been released to the public.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS