PT-2026-27233 · Opensource Workshop · Connect-Cms

Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-32300

Mitre

CVSS v3.1

8.1

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information. Versions 1.41.1 and 2.41.1 contain a patch.

Fix

IDOR

Improper Authorization

Weakness Enumeration

CWE-639

CWE-285

Related Identifiers

CVE-2026-32300

Affected Products

Connect-Cms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-32300 · Security Note
• https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1 · Note
• https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1 · Note
• https://github.com/opensource-workshop/connect-cms/commit/7c9951738c62a1d51b91e9956d1eb756c5d52cce · Note
• https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-qr6x-wvxr-8hm9 · Note