PT-2026-27232 · Unknown · Connect-Cms

Odgrso · Publicado 2026-03-23 · Atualizado 2026-03-24 · CVE-2026-32299

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Connect-CMS versions 1.x through 1.41.0 Connect-CMS versions 2.x through 2.41.0

Description An improper authorization issue in the page content retrieval feature may allow retrieval of non-public information. Insufficient authorization checks could allow processing associated with non-public pages to be executed, potentially allowing the contents and attachments of non-public pages to be obtained by a third party.

Recommendations For the 1.x series, update to version 1.41.1 or later. For the 2.x series, update to version 2.41.1 or later.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-32299

GHSA-62CH-J6X7-722J

Produtos afetados

Connect-Cms

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32299.json · Exploit
• https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-62ch-j6x7-722j · Aviso do Fabricante
• https://github.com/opensource-workshop/connect-cms · Nota
• https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1 · Nota
• https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32299 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-62ch-j6x7-722j · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-32299 · Aviso do Fabricante
• https://reddit.com/r/VulnMatter/comments/1s2f6l7/resumen_diario_de_vulnerabilidades_24032026 · Publicação no Reddit
• https://twitter.com/VulmonFeeds/status/2036301166863057256 · Publicação no Twitter