CVE-2026-35182 HIGH

CVE-2026-35182: Missing Authorization Privilege Escalation

Vendor Ajax30
Product BraveCMS-2.0
Weakness CWE-862 · Missing authorization
Published April 6, 2026
Last update April 7, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Brave CMS is an open-source CMS. Prior to 2.0.6, this vulnerability is a missing authorization check found in the update role endpoint at routes/web.php. The POST route for /rights/update-role/{id} lacks the checkUserPermissions:assign-user-roles middleware. This allows any authenticated user to change account roles and promote themselves to Super Admin. This vulnerability is fixed in 2.0.6.

Key dates

02Disclosure timeline

April 6, 2026 CVE published
April 7, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-43314 WordPress Asset CleanUp: Page Speed Booster plugin <= 1.3.9.3 - Broken Access Control vulnerability CVE-2026-32378 WordPress Book Landing Page theme <= 1.2.7 - Broken Access Control vulnerability CVE-2026-58448 yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API CVE-2023-0720 Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder_order CVE-2026-25436 WordPress Royal Elementor Addons plugin < 1.7.1053 - Broken Access Control vulnerability