CVE-2026-44392

Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://jvn.jp/en/jp/JVN66473735/
https://movabletype.org/news/2026/05/mt-908-released.html
https://www.sixapart.jp/movabletype/news/2026/05/20-1100.html

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-20 07:16

Updated : 2026-07-24 10:10

NVD link : CVE-2026-44392

Mitre link : CVE-2026-44392

CVE.ORG link : CVE-2026-44392

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-44392", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44392", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-20T13:03:54.098462Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vultures@jpcert.or.jp", "affectedData": [{"vendor": "Six Apart Ltd.", "product": "Movable Type", "versions": [{"status": "affected", "version": "9.1.1 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type", "versions": [{"status": "affected", "version": "9.0.7 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type", "versions": [{"status": "affected", "version": "8.8.3 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type", "versions": [{"status": "affected", "version": "8.0.10 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced", "versions": [{"status": "affected", "version": "9.1.1 and earlie"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced", "versions": [{"status": "affected", "version": "9.0.7 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced", "versions": [{"status": "affected", "version": "8.8.3 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced", "versions": [{"status": "affected", "version": "8.0.10 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium", "versions": [{"status": "affected", "version": "9.1.1 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium", "versions": [{"status": "affected", "version": "9.0.7 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium", "versions": [{"status": "affected", "version": "2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition)", "versions": [{"status": "affected", "version": "9.1.1 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition)", "versions": [{"status": "affected", "version": "9.0.7 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition)", "versions": [{"status": "affected", "version": "2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)"}]}]}], "published": "2026-05-20T07:16:15.317", "references": [{"url": "https://jvn.jp/en/jp/JVN66473735/", "source": "vultures@jpcert.or.jp"}, {"url": "https://movabletype.org/news/2026/05/mt-908-released.html", "source": "vultures@jpcert.or.jp"}, {"url": "https://www.sixapart.jp/movabletype/news/2026/05/20-1100.html", "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed."}, {"lang": "es", "value": "Vulnerabilidad de falta de autorizaci\u00f3n existe en Movable Type. Bajo ciertas condiciones, cuando un usuario sin privilegios de administrador inicia sesi\u00f3n en el producto, se puede ejecutar un procesamiento de actualizaci\u00f3n no intencionado."}], "lastModified": "2026-07-24T10:10:00.197", "sourceIdentifier": "vultures@jpcert.or.jp"}