CVE-2026-32300 | THREATINT

Description

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information. Versions 1.41.1 and 2.41.1 contain a patch.

PUBLISHED Reserved 2026-03-11 | Published 2026-03-23 | Updated 2026-03-25 | Assigner GitHub_M

HIGH: 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Problem types

CWE-285: Improper Authorization

CWE-639: Authorization Bypass Through User-Controlled Key

Product status

< 1.41.1

affected

>= 2.0.0, < 2.41.1

affected

References

github.com/...ct-cms/security/advisories/GHSA-qr6x-wvxr-8hm9

github.com/...ommit/7c9951738c62a1d51b91e9956d1eb756c5d52cce

github.com/...urce-workshop/connect-cms/releases/tag/v1.41.1

github.com/...urce-workshop/connect-cms/releases/tag/v2.41.1

cve.org (CVE-2026-32300)

nvd.nist.gov (CVE-2026-32300)

Download JSON