CVE-2026-93504
MediumCVSS 6.3Summary
A vulnerability in SveltyCMS 0.0.6 in the user attribute update endpoint allows improper access controls, letting a remote attacker modify user attributes without authorization. A patch is available as commit 05b4f9efeb79e9d72a693232334d7529687f896f.
Risk Assessment
Unauthorized modification of user attributes can lead to privilege escalation, account takeover, or data integrity issues in the system.
Recommendation
Apply the patch indicated (commit 05b4f9efeb79e9d72a693232334d7529687f896f) or upgrade SveltyCMS to a version that includes it.
Other vulnerabilities in SveltyCMS
See all- CVE-2026-93506Medium
A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called 05b4f9efeb79e9d72a693232334d7529687f896f. It is best practice to apply a patch to resolve this issue.
- CVE-2026-93505Low
SveltyCMS 0.0.6 contains a cross-site scripting (XSS) vulnerability in the SVG Media Upload component, in the file src/utils/media/media-service.server.ts. Input manipulation can lead to malicious script execution, and the attack can be initiated remotely.
Original NVD description (English source)
A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The name of the patch is 05b4f9efeb79e9d72a693232334d7529687f896f. It is advisable to implement a patch to correct this issue.