Is there a public PoC exploit available for CVE-2026-13544?

Yes, a public proof-of-concept exploit is available for CVE-2026-13544. Prioritise patching immediately. EPSS: 0.2%.

Feehi CMS CVE-2026-13544

Q: What is the CVSS score of CVE-2026-13544?

CVE-2026-13544 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40044 LOW

Improper Access Control (CWE-284)

2026-06-29 VulDB

GHSA-fgv8-397h-qgqf

Authentication Bypass Cms Feehi

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable API requires low-privilege auth (PR:L); no scope change; partial low impacts across C/I/A match described unauthorized data access and manipulation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 07:37 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 07:37 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 29, 2026 - 07:18 vuln.today

DescriptionCVE.org

A flaw has been found in Feehi CMS up to 2.1.1. Affected by this issue is some unknown functionality of the file /api/users of the component API. This manipulation causes improper access controls. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Improper access control in Feehi CMS up to version 2.1.1 allows low-privileged remote attackers to perform unauthorized operations against the /api/users API endpoint. Exploitation of CWE-284 at this endpoint enables access to or manipulation of user data beyond what the authenticated role should permit, representing an authentication bypass at the authorization layer. A public exploit exists per GitHub issue #89; no vendor patch or response has been issued as of analysis time, leaving the exposure unmitigated.

Technical ContextAI

Feehi CMS (CPE: cpe:2.3:a:feehi:cms:*:*:*:*:*:*:*:*) is a PHP-based content management system. The vulnerability resides in the REST API route /api/users, which fails to properly enforce access control checks consistent with CWE-284 (Improper Access Control). Rather than validating that the authenticated user's role authorizes the requested action - such as listing, reading, or modifying other accounts - the endpoint responds without sufficient authorization gating. This class of flaw typically arises when API layers are developed separately from the core role-based access control logic and access checks are omitted or incorrectly scoped. The CVSS 4.0 vector confirms network accessibility (AV:N) with low required privileges (PR:L), consistent with a scenario where any registered/authenticated user can trigger the flaw.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project was notified via GitHub issue report but has not responded. As a compensating control, operators should restrict access to the /api/users endpoint at the web server or reverse proxy layer, allowing only requests from trusted IP ranges or administrative networks; this reduces the network-accessible attack surface without disabling the CMS entirely. Alternatively, disabling the API entirely (if not operationally required) eliminates the attack surface with the trade-off of losing API-dependent integrations. Monitor GitHub at https://github.com/liufee/cms for a patch release and apply promptly once available. Consider migrating to an actively maintained CMS if this product remains unpatched for an extended period.