CVE-2026-44392
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Missing authorization in Movable Type allows a user without admin privileges to perform unintended updates after signing in.
Risk Assessment
Risk of unauthorized modification of data or system configuration by a regular user.
Recommendation
Update Movable Type to the latest patched version.
Other vulnerabilities in Movable Type
See all- CVE-2013-2184High
Movable Type before 5.2.6 does not properly use the Storable::thaw function, allowing remote attackers to execute arbitrary code via the comment_state parameter.
- CVE-2026-33088Critical
Movable Type by Six Apart Ltd. contains an SQL injection vulnerability that may allow an attacker to execute arbitrary SQL statements.
Original NVD description (English source)
Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS