PbootCMS versions up to 3.2.12 contain a flaw in the UserController.php component that permits remote manipulation of the Field argument. This weakness allows an attacker to alter arbitrary user data or configuration settings, bypassing the intended access controls and potentially enabling privilege escalation or unauthorized data modification. The vulnerability is classified under CWE‑266 and CWE‑284, indicating problems with authority management and improper access control.

The affected product is PbootCMS, specifically all releases up to and including 3.2.12. No other vendors or products are listed as impacted.

The CVSS v3.1 score is 5.3, representing a medium severity. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting it may not be actively exploited in the wild. Nonetheless, an exploit has been published and the attack can be carried out remotely, likely by sending crafted requests to the backend API. The lack of explicit authentication requirements in the description means the risk may vary depending on the deployment’s exposure, but a remote attacker with access to the backend portal could leverage this weakness.