CVE-2026-88421

HighCVSS 7.5

Published: 25/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 25/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

20th percentile - higher than 20% of all known CVEs

Summary

Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, tag, category, author and date archives, sidebar widgets, or RSS feed.

Risk Assessment

Unauthenticated attackers can access restricted blog content, potentially leading to a confidentiality breach.

Recommendation

Update APSL puput to a patched version or enforce proper permission checks in the BlogPage.get_entries() component.

Other vulnerabilities in APSL puput

CVE-2026-88420Medium
A reflected cross-site scripting (XSS) vulnerability exists in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0. An authenticated attacker with Wagtail Editor privileges can execute arbitrary code in the victim's browser via a crafted payload.

Original NVD description (English source)

Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS