VYPR
← All advisories
High severity8.8NVD Advisory· Published Apr 6, 2026· Updated Jul 24, 2026

CVE-2026-35182

CVE-2026-35182

Description

Brave CMS is an open-source CMS. Prior to 2.0.6, this vulnerability is a missing authorization check found in the update role endpoint at routes/web.php. The POST route for /rights/update-role/{id} lacks the checkUserPermissions:assign-user-roles middleware. This allows any authenticated user to change account roles and promote themselves to Super Admin. This vulnerability is fixed in 2.0.6.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Ajax30/Bravecms2 versions
    cpe:2.3:a:ajax30:bravecms:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:ajax30:bravecms:*:*:*:*:*:*:*:*range: >=2.0.0,<2.0.6
    • (no CPE)range: <2.0.6
  • Brave/Bravellm-fuzzy
    Range: <2.0.6

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.