Is there a public PoC exploit available for CVE-2026-13546?

Yes, a public proof-of-concept exploit is available for CVE-2026-13546. Prioritise patching immediately. EPSS: 0.4%.

Feehi CMS CVE-2026-13546

Q: What is the CVSS score of CVE-2026-13546?

CVE-2026-13546 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-40046 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-06-29 VulDB

GHSA-9vx2-hrrc-hrgq

Authentication Bypass Cms Feehi

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Endpoint is network-accessible with no authentication required; low CIA impact reflects constrained article-data scope with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 29, 2026 - 09:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jun 29, 2026 - 09:16 vuln.today

DescriptionCVE.org

A vulnerability was found in Feehi CMS up to 2.1.1. This vulnerability affects unknown code of the file /api/articles of the component REST API Endpoint. Performing a manipulation results in missing authentication. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Unauthenticated access to the /api/articles REST API endpoint in Feehi CMS up to version 2.1.1 exposes article management functions without any credential verification, allowing remote attackers to interact with CMS content at low complexity and zero privilege. A publicly available proof-of-concept exploit exists via a GitHub issue report. The vendor has not responded to the disclosure, leaving installations without an official patch; no KEV listing indicates no confirmed mass exploitation at time of analysis, but the no-authentication network vector makes this trivially accessible to any internet-facing attacker.

Technical ContextAI

Feehi CMS (CPE: cpe:2.3:a:feehi:cms:*:*:*:*:*:*:*:*) versions through 2.1.1 expose a REST API endpoint at /api/articles that fails to enforce authentication before processing requests. CWE-306 (Missing Authentication for Critical Function) is the root cause class: the application routes requests to article management functionality without validating a session token, API key, or any identity assertion from the caller. In REST API architectures this typically manifests as absent or misconfigured middleware that should gate access before dispatching to controller logic. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) independently confirms the endpoint is directly reachable over the network with no attack complexity, no prerequisite privileges, and no attacker-side special conditions required.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project was notified via issue report (https://github.com/liufee/cms/issues/87) but has not responded. Until a fix is released, administrators should restrict access to the /api/articles endpoint at the web server or reverse-proxy layer (e.g., deny all external requests to /api/ paths unless consumed by a known, controlled client - note this may break legitimate API integrations and should be tested before deployment). Alternatively, implement WAF rules requiring authenticated session or API-key headers on all /api/ routes, which adds a defense-in-depth layer without breaking functionality. If Feehi CMS remains unpatched for an extended period, migration to an actively maintained CMS platform should be evaluated. Monitor https://github.com/liufee/cms and https://vuldb.com/vuln/374554 for patch releases.