Log in Start free

Vulnerability · Published Mar 23, 2026 · Assigned by GitHub_M

CVE-2026-32300Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information

High 8.1

In plain English

A high-severity authorization bypass via user-controlled key in connect-cms from opensource-workshop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.3%top 76.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information. Versions 1.41.1 and 2.41.1 contain a patch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistopensource-workshop/connect-cms1.41.1GHSA-qr6x-wvxr-8hm9
Packagistopensource-workshop/connect-cms2.41.1GHSA-qr6x-wvxr-8hm9

Affected products (as reported)

VendorProductVersions
opensource-workshop connect-cms < 1.41.1>= 2.0.0, < 2.41.1

Weakness: CWE-285, CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References