Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature

Vulnerability

Overview

CVE-2026-32299 is an improper authorization vulnerability in the page content retrieval feature of Connect-CMS, a content management system. The flaw exists in all versions of the 1.x series up to and including 1.41.0, and all versions of the 2.x series up to and including 2.41.0 [1]. The root cause is a missing or insufficient authorization check when fetching page content, which allows an attacker to bypass intended access controls.

Exploitation

An attacker can exploit this vulnerability by sending crafted requests to the page content retrieval endpoint without proper authentication or authorization. No special privileges or network position are required beyond the ability to reach the CMS instance. The attack surface is the public-facing web interface, and the vulnerability can be triggered without any prior user interaction [1].

Impact

Successful exploitation leads to the retrieval of non-public information, such as restricted pages, drafts, or other sensitive content that should only be accessible to authorized users. This constitutes an information disclosure that could expose confidential data, internal notes, or unpublished materials [1].

Mitigation

The issue has been addressed in versions 1.41.1 and 2.41.1, which contain the necessary authorization fixes [2][4]. Users are strongly advised to upgrade to these patched versions immediately. No workarounds have been publicly documented, and the vendor has not indicated that the vulnerability is being actively exploited in the wild.