Vulnerability · Published Mar 23, 2026 · Assigned by GitHub_M
CVE-2026-32299Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature
High 7.5
In plain English
A high-severity improper access control in connect-cms from opensource-workshop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the page content retrieval feature may allow retrieval of non-public information. Versions 1.41.1 and 2.41.1 contain a patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | opensource-workshop/connect-cms | 1.41.1 | GHSA-62ch-j6x7-722j |
| Packagist | opensource-workshop/connect-cms | 2.41.1 | GHSA-62ch-j6x7-722j |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| opensource-workshop | connect-cms | < 1.41.1>= 2.0.0, < 2.41.1 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N