CVE-2026-95263: n/a

In Feehi CMS 2.1.1, a low-privilege backend administrator who has administrator-update permission can change the password of the built-in super administrator account without providing the old password. This occurs because the server does not enforce proper access control protections for the super administrator account during password updates, allowing unauthorized modification of this critical account.

An attacker with low-privilege backend administrator access can escalate privileges by changing the super administrator account password, potentially gaining full control over the CMS. This undermines the integrity of the administrative security model and could lead to complete system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator-update permissions to trusted users only and monitor administrative activities closely.