Description
A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-08-31
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

SeaCMS versions up to 13.6 contain a flaw within the /ass.php script that allows an attacker to bypass normal authorization checks. By manipulating the request, an attacker can gain unauthorized access to privileged functionality or data that should be protected, without needing valid credentials. The vulnerability is classified as an improper authorization weakness (CWE-285) and a missing authorization failure (CWE-639).

Affected Systems

The vulnerability affects SeaCMS content management systems running any version up to and including 13.6. The exact affected version strings are not enumerated, so any installation built on SeaCMS 13.6 or earlier is potentially vulnerable. The primary file impacted is /ass.php, a part of the platform’s authorization logic.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate impact that can lead to unauthorized data exposure or control within the CMS. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog. Because the exploit can be triggered remotely, attackers can target web‑facing instances without prior access. No specific prerequisites are listed, so the risk remains significant for any exposed SeaCMS installation.

Generated by OpenCVE AI on August 31, 2026 at 02:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade SeaCMS to the latest release that includes a fix for the /ass.php authorization logic.
  • If upgrading is not possible, restrict direct access to /ass.php by enforcing authentication checks or by setting file permissions so that only privileged users can execute it.
  • Deploy a Web Application Firewall rule that blocks suspicious or unauthenticated requests to the /ass.php endpoint, and monitor logs for attempted bypass attacks.

Generated by OpenCVE AI on August 31, 2026 at 02:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 01:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Title SeaCMS ass.php authorization
First Time appeared Seacms
Seacms seacms
Weaknesses CWE-285
CWE-639
CPEs cpe:2.3:a:seacms:seacms:*:*:*:*:*:*:*:*
Vendors & Products Seacms
Seacms seacms
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Seacms Seacms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T01:30:09.315Z

Reserved: 2026-08-30T06:42:39.909Z

Link: CVE-2026-82602

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T02:17:03.003

Modified: 2026-08-31T02:17:03.003

Link: CVE-2026-82602

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T02:30:18Z

Weaknesses
  • CWE-285

    Improper Authorization

  • CWE-639

    Authorization Bypass Through User-Controlled Key