CouchCMS contains a flaw that allows an authenticated Admin-level user to spoof the f_k_levels_list parameter during user sign‑up or edit. By changing the value from 4 to 10 in the HTTP request body, the user bypasses the application’s authorization check and is granted SuperAdmin privileges. This gives the attacker full control over the site, including modifying content, configuration, and other user accounts.

The vulnerability affects the CouchCMS content management system. Specific affected releases were not enumerated in the available data. Users should review the site’s current CouchCMS version against the vendor’s advisories.

The flaw carries a CVSS score of 8.6, indicating a high severity. No EPSS data or KEV listing is available. The attack requires an authenticated session with Admin level; once the parameter is tampered, the escalation is immediate and no additional privilege is needed. Because the vector relies on a known, authenticated account, the exploitation window is limited to environments where Admin access is available to potential attackers.