VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Apr 21, 2026· Updated May 13, 2026

CVE-2026-30452

CVE-2026-30452

Description

Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to modify articles owned by users with higher privileges. By manipulating the article ID parameter during the duplicate-and-save workflow in textpattern/include/txp_article.php, an attacker can bypass authorization checks and overwrite content belonging to other users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Textpattern/Textpatternreferences3 versions
    (expand)+ 2 more
    • (no CPE)
    • cpe:2.3:a:textpattern:textpattern:4.9.0:-:*:*:*:*:*:*
    • (no CPE)range: = 4.9.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.