Description
A vulnerability was found in FluentCMS up to 0.0.5. This affects the function GetAccessible of the file src/Backend/FluentCMS.Services/Permissions/PermissionManager.cs. Performing a manipulation results in missing authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-09-07
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Missing Authorization
Action: Patch
AI Analysis

Impact

The vulnerability arises from improper authorization in the GetAccessible function of PermissionManager.cs. By manipulating input, an attacker can bypass access checks to view or modify resources they should not have permission for, compromising confidentiality and integrity of data managed by FluentCMS. The flaw is available for remote exploitation and has been published for attackers to use.

Affected Systems

FluentCMS releases up to version 0.0.5 are affected. The issue targets the PermissionManager component within the FluentCMS project, and anyone deploying those releases is at risk.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity. EPSS data is not available, but the exploit is publicly disclosed and can be launched remotely. The vulnerability is not listed in the CISA KEV catalog, yet the availability of a public exploit suggests that exploitation could occur if no mitigation is applied.

Generated by OpenCVE AI on September 7, 2026 at 06:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FluentCMS to a version later than 0.0.5 once the vendor releases an update that addresses the authorization flaw.
  • If an immediate upgrade is not possible, isolate the affected system behind network controls and limit inbound traffic to only trusted sources to reduce the attack surface.
  • Apply an additional application‑level authorization layer to ensure that even if the underlying function is compromised, critical resources still enforce proper permission checks.

Generated by OpenCVE AI on September 7, 2026 at 06:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 05:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in FluentCMS up to 0.0.5. This affects the function GetAccessible of the file src/Backend/FluentCMS.Services/Permissions/PermissionManager.cs. Performing a manipulation results in missing authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Title FluentCMS PermissionManager.cs GetAccessible authorization
First Time appeared Fluentcms
Fluentcms fluentcms
Weaknesses CWE-862
CWE-863
CPEs cpe:2.3:a:fluentcms:fluentcms:*:*:*:*:*:*:*:*
Vendors & Products Fluentcms
Fluentcms fluentcms
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Fluentcms Fluentcms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-09T14:14:47.102Z

Reserved: 2026-09-06T12:51:03.719Z

Link: CVE-2026-86271

cve-icon Vulnrichment

Updated: 2026-09-09T14:14:41.595Z

cve-icon NVD

Status : Deferred

Published: 2026-09-07T05:16:55.210

Modified: 2026-09-09T15:17:15.700

Link: CVE-2026-86271

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T07:00:09Z

Weaknesses