A weakness in Subrion CMS’s iaUsers::authorize function allows manipulation of the $_SERVER['HTTP_REFERER'] header in the login endpoint. This results in a browser redirect to an attacker‑supplied URL after authentication. The CVE description confirms that the flaw can be exploited remotely and that a public exploit is available, meaning a user who logs in may be unknowingly sent to a malicious site.

Intelliants Subrion CMS versions up to and including 4.2.1 are affected, specifically the authentication component located in front/login.php.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The exploit is publicly available and requires only a crafted HTTP_REFERER header sent to the login endpoint; no local privileges or authentication bypass are needed. Therefore the risk of exploitation is non‑zero.