Vulnerability · Published Jan 2, 2026 · Assigned by GitHub_M
CVE-2026-21429Emlog has Broken Access Control (BAC)
Low 2.0
In plain English
A low-severity missing authorization in emlog from emlog. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 4.0)2.0Low
Exploit odds (30 days)0.2%top 85.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Emlog is an open source website building system. In version 2.5.23, the admin can set controls which makes users unable to edit or delete their articles after publishing them. As of time of publication, no known patched versions are available.
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
References
- https://github.com/emlog/emlog/security/advisories/GHSA-jw5v-2g53-rx8w x_refsource_CONFIRM