Vulnerability Details CVE-2026-29002
CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass authorization validation and gain full application control, circumventing restrictions on SuperAdmin account creation and privilege assignment.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 12.8%
CVSS Severity
CVSS v3 Score 7.2
References
Products affected by CVE-2026-29002
-
cpe:2.3:a:couchcms:couchcms:1.3.5
-
cpe:2.3:a:couchcms:couchcms:1.4
-
cpe:2.3:a:couchcms:couchcms:1.4.5
-
cpe:2.3:a:couchcms:couchcms:1.4.7
-
cpe:2.3:a:couchcms:couchcms:2.0
-
cpe:2.3:a:couchcms:couchcms:2.1
-
cpe:2.3:a:couchcms:couchcms:2.2
-
cpe:2.3:a:couchcms:couchcms:2.2.1
-
cpe:2.3:a:couchcms:couchcms:2.3