CVE-2026-86271: Missing Authorization in FluentCMS
Description
A vulnerability was found in FluentCMS up to 0.0.5. This affects the function GetAccessible of the file src/Backend/FluentCMS.Services/Permissions/PermissionManager.cs. Performing a manipulation results in missing authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0
Score 5.1medium
Affected software
FluentCMS
cpe:2.3:a:fluentcms:fluentcms:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects FluentCMS up to version 0.0.5 in the GetAccessible function of src/Backend/FluentCMS.Services/Permissions/PermissionManager.cs. The issue is a missing authorization check that can be exploited remotely without user interaction. The vulnerability was responsibly disclosed early to the project, but no fix or official response has been provided. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.
Potential Impact
An attacker can remotely exploit this missing authorization vulnerability to bypass access controls in FluentCMS, potentially gaining unauthorized access to resources or functionality. The impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. No active exploitation in the wild is currently known.
Mitigation Recommendations
No official fix or patch is currently available as the vendor has not responded to the report. Users should monitor the vendor's channels for updates and consider implementing additional access control measures or network-level restrictions to limit exposure until a patch is released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-06T12:51:03.719Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9e433eacd9273b49f6de27
Added to database: 09/07/2026, 04:53:18 UTC
Last enriched: 09/15/2026, 00:38:51 UTC
Last updated: 10/22/2026, 13:15:24 UTC
Views: 90
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.