The vulnerability in Feehi CMS 2.1.1 is an Incorrect Access Control flaw that permits a low‑privilege backend administrator with "administrator‑update" permission to directly change the password of the built‑in super administrator account. Because the server does not enforce protection for that account and the update operation does not require the old password, an attacker can elevate their credential to super‑admin status without knowledge of the current password, compromising confidentiality, integrity, and availability of all content and configuration managed by the CMS.

Feehi CMS version 2.1.1 is the affected implementation. No additional vendor or product variants are indicated in the available data.

The exploit does not require user interaction beyond possessing backend administrator privileges. If an attacker has such privileges, they can change the super‑administrator password without knowing the old password. This is inferred from the described update flow; the threat of reaching such privileges depends on the organization’s internal control. The CVSS score is 7.2, indicating high severity. The EPSS score of 0.00198 indicates a very low probability of exploitation. No public exploit score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation may be limited to known or recent installations. However, the absence of old‑password verification in the update flow makes it straightforward for any holder of update rights to compromise the super‑admin account, presenting a high‑severity risk if such users exist.