High severity8.8NVD Advisory· Published Sep 5, 2019· Updated Jun 17, 2026
CVE-2019-15953
CVE-2019-15953
Description
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the associated API. The product correctly manages privileges only for the front-end resource path, not for API requests. This leads to vertical and horizontal privilege escalation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:a:totaljs:total.js_cms:12.0.0:*:*:*:*:*:*:*
- Total.js/Total.js CMSdescription
- ghsa-coords
Patches
Vulnerability mechanics
References
4- github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdfnvdExploitThird Party AdvisoryWEB
- seclists.org/fulldisclosure/2019/Sep/6nvdExploitMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-q3x9-28f7-w8rcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2019-15953ghsaADVISORY
News mentions
0No linked articles in our index yet.