CVE-2026-30452 describes a broken access control vulnerability in Textpattern CMS 4.9.0. The vulnerability exists in the article management system, specifically in the duplicate-and-save workflow implemented in textpattern/include/txp_article.php. By altering the article ID parameter, an authenticated user with lower privileges can bypass authorization checks and overwrite articles owned by users with higher privileges. This allows unauthorized modification of content within the CMS.

The vulnerability allows unauthorized modification of articles by users who should not have permission to do so. This can lead to content integrity issues, potential misinformation, or defacement within the CMS. There is no indication of privilege escalation beyond article modification or other impacts such as data disclosure or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the article management system to trusted users only and monitor for unusual article modifications. Avoid granting unnecessary article management privileges to low-privileged users.