CVE-2026-86271

2.0 lowEPSS 0.4%

A vulnerability was found in FluentCMS up to 0.0.5. This affects the function GetAccessible of the file src/Backend/FluentCMS.Services/Permissions/PermissionManager.cs. Performing a manipulation results in missing authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Severity

CVSS 4.0

2.0 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

4.7 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWEs: CWE-862, CWE-863
Published: 2026-09-07
Modified: 2026-09-09
Record from: the NVD, synced 2026-10-19

References

https://github.com/fluentcms/FluentCMS/
https://github.com/fluentcms/FluentCMS/issues/2409
https://vuldb.com/cve/CVE-2026-86271
https://vuldb.com/submit/904824
https://vuldb.com/vuln/399430

Check your stack JSON