Connect CMS contains an improper authorization flaw in the My Page profile update feature that permits an attacker to alter arbitrary user information. The vulnerability is rooted in CWE-285 and CWE-639, indicating that authentication and authorization controls are insufficient. Because of this weakness, an attacker could change profile details, potentially fabricating credentials or personal data, thereby degrading data integrity and possibly enabling further account compromise.

The issue affects all Connect CMS releases in the 1.x series up to and including 1.41.0 and in the 2.x series up to and including 2.41.0. The vendor, opensource‑workshop, released patches in versions 1.41.1 and 2.41.1 to address the flaw.

A CVSS score of 8.1 classifies the vulnerability as high severity, while an EPSS score below 1% indicates it is not widely exploited yet. The flaw is reachable remotely via the web interface, so an attacker who obtains web access could send crafted profile update requests, a step that is inferred from the description. Although the vulnerability is not listed in the CISA KEV catalog, the potential for unauthorized data alteration and subsequent privilege escalation remains significant.