The issue in FeehiCMS v.2.1.1 allows an attacker to gain higher privileges by manipulating the session management, authentication, and logout processes, potentially giving the attacker full administrative control over the CMS. The flaw arises from improper handling of session state, enabling users authenticated with a lower role to acquire higher‑level permissions.

This vulnerability affects FeehiCMS v.2.1.1. No confirmed data indicates whether other versions or products are affected; the CNA vendor/product information is unknown.

The EPSS score is below 1%, indicating a low probability of public exploitation at this time, and the vulnerability is not listed in CISA's KEV catalog. However, the potential for complete administrative takeover makes the risk high for affected systems. The likely attack vector is remote, via a web request that manipulates the session or authentication flow; the attacker could exploit the flaw without needing physical access or additional privileges. The CVSS score of 7.4 indicates a high severity, reflecting the potential for complete administrative takeover in terms of confidentiality, integrity, and availability.