PT-2026-30714 · Brave Cms · Brave Cms

Para213 · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-35182

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Brave CMS versions prior to 2.0.6

Description Brave CMS is an open-source CMS. Prior to version 2.0.6, a missing authorization check exists in the update role endpoint located at /routes/web.php. Specifically, the POST route /rights/update-role/{id} lacks the checkUserPermissions:assign-user-roles middleware. This allows any authenticated user to modify account roles and elevate privileges to Super Admin.

Recommendations Update Brave CMS to version 2.0.6 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-35182

Affected Products

Brave Cms

References · 5

• 🔥 https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-g58h-mvjw-f4hv · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-35182 · Security Note
• https://twitter.com/CveFindCom/status/2041255437526306869 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041252463756374083 · Twitter Post
• https://twitter.com/CVEnew/status/2041250720549061099 · Twitter Post