Incorrect authorization in DotNetNuke - #VU146092
Published: August 28, 2026
Vulnerability identifier: #VU146092
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform unauthorized administrative actions within affected modules.
The vulnerability exists due to incorrect authorization in the permission evaluation logic when evaluating module permissions in the presence of broader page-level permissions. A remote privileged user can use page-level content management permissions to access module administration features and perform unauthorized administrative actions within affected modules.
User interaction is required.
Affected software
DotNetNuke
Remediation
Install security update from vendor's website.
DotNetNuke - update to 10.3.3