CVE-2026-29002

CouchCMS Privilege Escalation via f_k_levels_list Parameter

Published Apr 10, 2026 CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Description

CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass authorization validation and gain full application control, circumventing restrictions on SuperAdmin account creation and privilege assignment.

Analysis

Technical impact

CouchCMS contains a flaw that allows an authenticated Admin-level user to spoof the f_k_levels_list parameter during user sign‑up or edit. By changing the value from 4 to 10 in the HTTP request body, the user bypasses the application’s authorization check and is granted SuperAdmin privileges. This gives the attacker full control over the site, including modifying content, configuration, and other user accounts.

Affected Systems

The vulnerability affects the CouchCMS content management system. Specific affected releases were not enumerated in the available data. Users should review the site’s current CouchCMS version against the vendor’s advisories.

Risk and Exploitability

The flaw carries a CVSS score of 8.6, indicating a high severity. No EPSS data or KEV listing is available. The attack requires an authenticated session with Admin level; once the parameter is tampered, the escalation is immediate and no additional privilege is needed. Because the vector relies on a known, authenticated account, the exploitation window is limited to environments where Admin access is available to potential attackers.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

CouchCMS

unknown

Version	Status	Constraints
`0`	affected	≤ 2.4.0

Configuration 1 [-]

cpe:2.3:a:couchcms:couchcms:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Couchcms

Version	Status	Scheme	Platform
`[0,2.4.0]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade CouchCMS to the latest version released by the vendor.
Verify that all user creation forms validate the f_k_levels_list parameter and that it cannot be manipulated by external input.
Audit existing SuperAdmin and Admin accounts for unauthorized creation or privilege changes and enforce strict access controls.

Generated by OpenCVE AI on April 10, 2026 at 16:21 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.443% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://gist.github.com/thepiyushkumarshukla/477e2d2bbbe8cc3ec0d640c50f0cf9e1
https://www.couchcms.com/
https://www.vulncheck.com/advisories/couchcms-privilege-escalation-via-f-k-levels-list-parameter

History

Apr 16, 2026 7:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:couchcms:couchcms::::::::

Apr 13, 2026 1:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Couchcms Couchcms couchcms
Vendors & Products		Couchcms Couchcms couchcms

Apr 10, 2026 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 10, 2026 3:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass authorization validation and gain full application control, circumventing restrictions on SuperAdmin account creation and privilege assignment.
Title		CouchCMS Privilege Escalation via f_k_levels_list Parameter
Weaknesses		CWE-639
References		https://gist.github.com/thepiyushkumarshukla/477e2d2bbbe8cc3ec0d640c50f0cf9e1 https://www.couchcms.com/ https://www.vulncheck.com/advisories/couchcms-privilege-escalation-via-f-k-levels-list-parameter
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`