Vulnerability · Published Mar 21, 2026 · Assigned by VulDB
CVE-2026-4514PbootCMS Backend UserController.php access control
Medium 6.3
In plain English
A medium-severity improper access control in PbootCMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 88.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A flaw has been found in PbootCMS up to 3.2.12. Affected by this issue is some unknown functionality of the file apps/admin/controller/system/UserController.php of the component Backend. Executing a manipulation of the argument Field can lead to improper access controls. The attack may be performed from remote. The exploit has been published and may be used.
Affected products (as reported)
Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-352079 | PbootCMS Backend UserController.php access control vdb-entry, technical-description
- VDB-352079 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #773907 | 翱云科技 PbootCMS 3.2.12 Backend Arbitrary Field Modification via field and value Paramet third-party-advisory
- https://github.com/zzj-create/cvetest/blob/main/VULN-06_BACKEND_ARBITRARY_FIELD_MODIFICATION_REPORT_EN.md#vuln-06-pbootcms-3212-backend-arbitrary-field-modification exploit