PT-2026-27232 · Unknown · Connect-Cms

Odgrso · Published 2026-03-23 · Updated 2026-03-24 · CVE-2026-32299

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Connect-CMS versions 1.x through 1.41.0 Connect-CMS versions 2.x through 2.41.0

Description An improper authorization issue in the page content retrieval feature may allow retrieval of non-public information. Insufficient authorization checks could allow processing associated with non-public pages to be executed, potentially allowing the contents and attachments of non-public pages to be obtained by a third party.

Recommendations For the 1.x series, update to version 1.41.1 or later. For the 2.x series, update to version 2.41.1 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-32299

GHSA-62CH-J6X7-722J

Affected Products

Connect-Cms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32299.json · Exploit
• https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-62ch-j6x7-722j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32299 · Security Note
• https://osv.dev/vulnerability/GHSA-62ch-j6x7-722j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32299 · Vendor Advisory
• https://github.com/opensource-workshop/connect-cms · Note
• https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1 · Note
• https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1 · Note
• https://reddit.com/r/VulnMatter/comments/1s2f6l7/resumen_diario_de_vulnerabilidades_24032026 · Reddit Post
• https://twitter.com/VulmonFeeds/status/2036301166863057256 · Twitter Post