Emlog, a website building system, includes a configuration option that allows an administrator to set a control which blocks users from editing or deleting their articles after the articles have been published. This restriction is enforced through the application’s access control logic and is identified as a Broken Access Control weakness (CWE-862). The result is that legitimate users lose the ability to modify or remove their own content, compromising user experience and potentially violating data integrity expectations. The vulnerability does not allow an attacker to gain higher privileges or execute arbitrary code, but it does limit correct functionality for authenticated users.

The affected product is Emlog version 2.5.23, as identified by the vendor "emlog:emlog". No other product versions are listed as impacted.

The CVSS base score is 2.0, indicating low severity, and the estimated Exploit Probability is less than 1 %, with no current listing in the CISA Known Exploited Vulnerabilities catalog. The vulnerability is a logical error in the application’s permission checks and is not exploitable by an unauthenticated attacker. The attack vector is limited to actions performed within the application’s administrative interface, requiring administrator authorization. Overall, the risk is low but the issue affects legitimate users’ ability to manage their content.