A security vulnerability has been detected in SeaCMS up to 13.6. (CVE-2026-82602)

CVE-2026-82602 is an authorization bypass vulnerability in SeaCMS up to version 13.6. It involves manipulation of unknown code within the /ass.php file, enabling an attacker to bypass authorization mechanisms remotely without requiring privileges or user interaction. The vulnerability is classified under CWE-285 (Improper Authorization). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality impact. No patch or remediation details are provided in the available data.

Successful exploitation of this vulnerability allows an attacker to bypass authorization controls remotely, potentially granting unauthorized access to restricted functionality or data within SeaCMS. The confidentiality impact is limited, and there is no impact on integrity or availability reported. No active exploitation in the wild is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the vulnerable endpoint (/ass.php) or implementing additional access controls as a temporary mitigation.