CVE-2026-35182
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In Brave CMS prior to 2.0.6, the update role endpoint lacks authorization checks, allowing any authenticated user to change roles and become Super Admin.
Risk Assessment
An authenticated attacker can gain full control over the system through privilege escalation.
Recommendation
Update Brave CMS to version 2.0.6 or later.
Other vulnerabilities in Brave CMS
See all- CVE-2026-41576High
Brave CMS prior to commit 6c56603 had a publicly accessible contact form, allowing for the injection of unsafe HTML into email content. User-supplied message text was processed by the nl2br() function, which did not sanitize HTML, enabling attackers to create phishing interfaces in emails sent to the administrator.
- CVE-2026-41524High
Brave CMS prior to commit 6c56603 stored page and article body content entered by editor-role users through CKEditor verbatim in the database. As a result, any JavaScript or HTML injected by them was permanently stored and executed in every visitor's browser upon page load.
- CVE-2026-35183High
An IDOR vulnerability in the article image deletion feature in Brave CMS prior to 2.0.6. The deleteImage method in ArticleController.php accepts a filename from the URL without ownership verification, allowing an authenticated user with edit permissions to delete images attached to other users' articles.
Original NVD description (English source)
Brave CMS is an open-source CMS. Prior to 2.0.6, this vulnerability is a missing authorization check found in the update role endpoint at routes/web.php. The POST route for /rights/update-role/{id} lacks the checkUserPermissions:assign-user-roles middleware. This allows any authenticated user to change account roles and promote themselves to Super Admin. This vulnerability is fixed in 2.0.6.