CVE-2026-38930 describes an authentication bypass vulnerability in OpenRapid RapidCMS v1.3.1. The vulnerability exists in the /template/default/menu.php component and is exploited by injecting a crafted SQL payload into the 'name' cookie parameter. This SQL injection allows an attacker to bypass authentication mechanisms. The CVSS 3.1 score of 6.5 reflects a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability allows an attacker to bypass authentication controls, potentially gaining unauthorized access to the application. The impact affects confidentiality and integrity but does not affect availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, monitoring for updates from the vendor is recommended. No specific temporary mitigations are provided in the available data.