Vulnerability · Published Apr 10, 2026 · Assigned by VulnCheck

CVE-2026-29002CouchCMS Privilege Escalation via f_k_levels_list Parameter

High 7.2

In plain English

A high-severity authorization bypass via user-controlled key in CouchCMS from CouchCMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.4%top 62.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass authorization validation and gain full application control, circumventing restrictions on SuperAdmin account creation and privilege assignment.

Affected products (as reported)

Vendor	Product	Versions
CouchCMS	CouchCMS	0 – through 2.4.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://gist.github.com/thepiyushkumarshukla/477e2d2bbbe8cc3ec0d640c50f0cf9e1 technical-description, exploit
https://www.couchcms.com/ product
https://www.vulncheck.com/advisories/couchcms-privilege-escalation-via-f-k-levels-list-parameter third-party-advisory