CVE-2026-112239
The extension provides a backend endpoint that writes a submitted value into a submitted field of a…
- Risk score
- 49/100
- CVSS
- 7.2 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and …
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.2 high
References
Original description
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
Last activity 20 Oct 2026. Patch Forecast updates every hour.