Incorrect authorization in October CMS - #VU156195
Published: October 19, 2026
Vulnerability identifier: #VU156195
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to bypass Tailor sub-permission checks and publish or overwrite entries within an accessible section without the corresponding permissions.
The vulnerability exists due to incorrect authorization in the Tailor bulk action controller when processing section imports. A remote privileged user can submit import data setting is_enabled and published_at or use update_existing to publish or overwrite entries without the sub-permissions enforced by the standard entry editor.
A meaningful privilege gap arises only in deployments that split base, create, and publish permissions across distinct roles.
Affected software
October CMS
Remediation
Install security update from vendor's website.
October CMS - update to 4.2.25