October CMS allows an authenticated backend user who holds a generic editor role but lacks the editor.cms_assets or editor.tailor_blueprints sub‑permissions to create, delete, rename, move, or upload theme asset files and blueprint files. This bypass enables the user to modify or replace critical theme files and blueprint configurations, thereby compromising the integrity of the CMS installation. The flaw is based on a missing fine‑grained sub‑permission check and satisfies CWE-863 (Implicit Privilege Escalation).

The vulnerability is present in October CMS versions older than 3.7.16 and 4.1.16, affecting only the October CMS product and its Tailor editor extension under the special case where a user is explicitly given the editor role but the specific asset or blueprint sub‑permissions are omitted. These versions are not patched until the targeted release updates the permission checks.

The CVSS score of 3.3 indicates low severity overall, and no EPSS score is available, suggesting limited publicly documented exploitation. The flaw is exploitable only via an authenticated backend session and requires a specific, uncommon permission configuration. Regardless, an attacker who can establish a backend login might modify assets or blueprints, potentially leading to indirect code execution or configuration changes. The vulnerability is not listed in the CISA KEV catalog.