PT-2026-34006 · Unknown · Textpattern Cms

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-30452

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Textpattern CMS version 4.9.0

Description A Broken Access Control issue exists in the article management system. Authenticated users with low privileges can modify articles owned by users with higher privileges by manipulating the article ID parameter during the duplicate-and-save workflow in the endpoint 'textpattern/include/txp article.php'. This allows an attacker to bypass authorization checks and overwrite content belonging to other users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-30452

Affected Products

Textpattern Cms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-30452 · Security Note
• https://github.com/textpattern/textpattern · Note
• https://twitter.com/CVEnew/status/2046636260576428188 · Twitter Post
• https://textpattern.com/weblog/textpattern-491-released-security-fixes-patches-and-tweaks · Note
• https://twitter.com/infoflowcloud/status/2046637713164521545 · Twitter Post