CVE-2026-35182

Brave CMS is an open-source CMS. Prior to 2.0.6, this vulnerability is a missing authorization check found in the update role endpoint at routes/web.php. The POST route for /rights/update-role/{id} lacks the checkUserPermissions:assign-user-roles middleware. This allows any authenticated user to change account roles and promote themselves to Super Admin. This vulnerability is fixed in 2.0.6.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-g58h-mvjw-f4hv	Exploit Vendor Advisory
https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-g58h-mvjw-f4hv	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ajax30:bravecms:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-06 20:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-35182

Mitre link : CVE-2026-35182

CVE.ORG link : CVE-2026-35182

JSON object : View

Products Affected

ajax30

bravecms

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-35182", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35182", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T14:03:57.230451Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Ajax30", "product": "BraveCMS-2.0", "versions": [{"status": "affected", "version": "< 2.0.6"}]}]}], "published": "2026-04-06T20:16:26.553", "references": [{"url": "https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-g58h-mvjw-f4hv", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-g58h-mvjw-f4hv", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Brave CMS is an open-source CMS. Prior to 2.0.6, this vulnerability is a missing authorization check found in the update role endpoint at routes/web.php. The POST route for /rights/update-role/{id} lacks the checkUserPermissions:assign-user-roles middleware. This allows any authenticated user to change account roles and promote themselves to Super Admin. This vulnerability is fixed in 2.0.6."}, {"lang": "es", "value": "Brave CMS es un CMS de c\u00f3digo abierto. Antes de la versi\u00f3n 2.0.6, esta vulnerabilidad es una comprobaci\u00f3n de autorizaci\u00f3n faltante encontrada en el endpoint de actualizaci\u00f3n de rol en routes/web.php. La ruta POST para /rights/update-role/{id} carece del middleware checkUserPermissions:assign-user-roles. Esto permite a cualquier usuario autenticado cambiar los roles de la cuenta y ascenderse a s\u00ed mismos a Super Administrador. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.0.6."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ajax30:bravecms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68058898-316C-481E-A190-0E50C51A015D", "versionEndExcluding": "2.0.6", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}