CVE-2026-32300

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information. Versions 1.41.1 and 2.41.1 contain a patch.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/opensource-workshop/connect-cms/commit/7c9951738c62a1d51b91e9956d1eb756c5d52cce	Patch
https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1	Release Notes
https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1	Release Notes
https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-qr6x-wvxr-8hm9	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:opensource-workshop:connect-cms::::::::
	cpe:2.3:a:opensource-workshop:connect-cms::::::::

History

No history.

Information

Published : 2026-03-23 22:16

Updated : 2026-03-24 20:40

NVD link : CVE-2026-32300

Mitre link : CVE-2026-32300

CVE.ORG link : CVE-2026-32300

JSON object : View

Products Affected

opensource-workshop

connect-cms

CWE

CWE-285

Improper Authorization

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-32300", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2026-03-23T22:16:27.933", "references": [{"url": "https://github.com/opensource-workshop/connect-cms/commit/7c9951738c62a1d51b91e9956d1eb756c5d52cce", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-qr6x-wvxr-8hm9", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information. Versions 1.41.1 and 2.41.1 contain a patch."}, {"lang": "es", "value": "Connect-CMS es un sistema de gesti\u00f3n de contenido. En versiones de la serie 1.x hasta la 1.41.0 inclusive y versiones de la serie 2.x hasta la 2.41.0 inclusive, un problema de autorizaci\u00f3n impropia en la funci\u00f3n de actualizaci\u00f3n de perfil Mi P\u00e1gina puede permitir la modificaci\u00f3n de informaci\u00f3n de usuario arbitraria. Las versiones 1.41.1 y 2.41.1 contienen un parche."}], "lastModified": "2026-03-24T20:40:41.447", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opensource-workshop:connect-cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "60B8BBDF-82BD-486D-AE17-7F59360E62C3", "versionEndExcluding": "1.41.1", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:opensource-workshop:connect-cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C11B4F0-DF29-473A-A285-9DA152DDCDE1", "versionEndExcluding": "2.41.1", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}