The vulnerability allows an attacker to invoke install.php with action=reinstall without any authentication, causing the script to overwrite config.php with attacker-supplied database credentials and to create a new administrator user. This grants the attacker full administrative control of the site, exposing it to further compromise and abuse. The weakness is a lack of authentication for a sensitive operation, identified as CWE‑306.

emlog – e‑mail blog system. Versions 2.6.26 and all earlier releases are affected. No fix version is currently available, so any deployment of 2.6.26 or older remains vulnerable.

The CVSS score of 9.8 indicates critical severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. The attack vector is remote, requiring only the ability to issue HTTP requests to the install.php endpoint; no local privileges or additional credentials are needed. Because the authentication guard is bypassed for the reinstall action, exploitation is straightforward for an unauthenticated attacker.