Textpattern CMS 4.9.0 contains a broken access control flaw that enables authenticated users with low privileges to alter articles belonging to users with higher privileges. The vulnerability arises when the article ID parameter is manipulated during the duplicate-and-save workflow in txp_article.php, allowing an attacker to bypass authorization checks and overwrite target content. This flaw can be leveraged to tamper with confidential or strategically important articles, impacting the integrity of published material and potentially leading to misinformation or loss of trust.

The vulnerability affects Textpattern CMS version 4.9.0 and potentially earlier releases that have not applied the patch included in the 4.9.1 security release. It specifically targets the article management subsystem located in txp_article.php and the duplicate-and-save operation exposed to authenticated users.

Although EPSS data is unavailable and the vulnerability is not listed in CISA KEV, the flaw permits privilege escalation within the CMS, enabling attackers to modify content that would otherwise be protected. Based on the description, the likely attack vector is an authenticated user who can control the article ID parameter during duplication. The high potential for compromising content integrity suggests a severe risk posture, warranting immediate attention.