Description
A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-12
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Improper Authorization leading to unauthorized user deletion
Action: Assess Impact
AI Analysis

Impact

An improper authorization flaw exists in /admin/SEMCMS_User.php when the Class parameter is set to Deleted and CF=user, allowing a remote user to delete arbitrary user accounts. The flaw permits attackers to bypass normal access controls and perform destructive operations without proper authentication, potentially causing loss of user data and disrupting system functionality.

Affected Systems

SEMCMS versions up to 5.0 are affected by this vulnerability. The flaw is present in the core CMS code and is not limited to any particular deployment environment.

Risk and Exploitability

The CVSS score of 6.9 categorizes this as a moderate severity vulnerability. EPSS is not available, and it is not listed in the CISA KEV catalog. Attackers can exploit the issue remotely, as documented by public disclosures. With no patch or vendor response currently available, the threat remains significant for any site running a vulnerable SEMCMS installation.

Generated by OpenCVE AI on October 12, 2026 at 09:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict access to the /admin/SEMCMS_User.php endpoint so that only authenticated administrators can reach it, for example by moving the administrative interface behind a firewall or implementing IP whitelisting.
  • Wait for an official fix from SEMCMS and apply it immediately when released; regularly monitor vendor communications for updates.
  • Enhance the application by adding a server‑side authorization check before executing any delete operation to ensure the user has the required privileges.

Generated by OpenCVE AI on October 12, 2026 at 09:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title SEMCMS SEMCMS_User.php user improper authorization
First Time appeared Semcms
Semcms semcms
Weaknesses CWE-266
CWE-285
CPEs cpe:2.3:a:semcms:semcms:*:*:*:*:*:*:*:*
Vendors & Products Semcms
Semcms semcms
References
Metrics cvssV2_0

{'score': 6.4, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Semcms Semcms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-15T15:16:09.470Z

Reserved: 2026-10-11T10:18:15.330Z

Link: CVE-2026-108812

cve-icon Vulnrichment

Updated: 2026-10-15T14:52:32.795Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T08:17:19.187

Modified: 2026-10-15T16:17:38.177

Link: CVE-2026-108812

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:30:14Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-285

    Improper Authorization