CVE-2026-102249 MEDIUM

CVE-2026-102249: REBUILD file-editor-save authorization

Vendor N/A
Product REBUILD
Weakness CWE-862 · Missing authorization
Published September 29, 2026
Last update September 29, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of the argument url/fileKey results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

September 29, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2026-19801 BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action CVE-2026-66431 WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability CVE-2026-81761 WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability CVE-2026-74003 WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability CVE-2026-66469 WordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerability