CVE-2026-29002
HIGHCouchCMS Privilege Escalation via f_k_levels_list Parameter
Title source: cnaDescription
CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass authorization validation and gain full application control, circumventing restrictions on SuperAdmin account creation and privilege assignment.
Scores
CVSS v3
7.2
EPSS
0.0004
EPSS Percentile
12.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-639
Status
published
Products (2)
couchcms/couchcms
< 2.4
CouchCMS/CouchCMS
< 2.4.0
Published
Apr 10, 2026
Tracked Since
Apr 10, 2026