EUVD-2026-46076
GHSA-wh8m-xg73-3924
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 20, 2026
Privilege escalation to remote code execution in dotCMS 21.02 through 26.06.22-03 lets a low-privileged authenticated backend user abuse improper authorization checks in the ToolGroupResource (REST) and RoleAjax (DWR) endpoints to self-assign the administrative layout and self-grant the CMS Administrator role, then upload a crafted OSGi bundle whose BundleActivator runs arbitrary shell commands on the host. The endpoints failed to verify the caller was an admin before honoring layout- and role-assignment requests, so any backend account could bootstrap itself to full administrator. There is no public exploit identified at time of analysis, but an upstream fix (PR #36344) is available and the vendor-supplied CVSS 4.0 score is 9.4 (Critical).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Dotcms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from Vendor (dotCMS) · only source for this CVE.
CVSS VectorVendor: dotCMS
DescriptionCVE.org
Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote code execution via a crafted OSGi bundle upload whose BundleActivator executes arbitrary shell commands.
Executive ViewAI
dotCMS versions 21.02 through 26.06.22-03 contain a critical privilege escalation vulnerability allowing any authenticated backend user to elevate to administrator access and execute arbitrary code on hosting systems; no public exploit identified at time of analysis. Organizations running affected versions face immediate risk of complete system compromise and data breach through an attack requiring only basic backend account credentials.
Within 24 hours, inventory all dotCMS installations and versions; restrict backend user access to only authorized personnel and review recent backend account creation logs. Within 7 days, contact dotCMS vendor regarding patch timeline and inquire about the status of upstream fix PR #36344; implement network segmentation to restrict access to ToolGroupResource and RoleAjax endpoints to administrators only; enable comprehensive audit logging for role assignments, layout changes, and OSGi bundle uploads. Within 30 days, be prepared to apply any released patch immediately or evaluate manual application of the upstream PR if no official release is available; prioritize this as a critical infrastructure change.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict backend user account access to administrators only; deploy WAF or firewall rules to block unauthorized requests to the ToolGroupResource and RoleAjax endpoints; enable detailed audit logging for all role assignments, layout modifications, and bundle deployments; implement real-time alerting on role elevation attempts or administrative account changes; conduct daily reviews of backend user account privileges; monitor for unusual OSGi bundle activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Rated critical severity (CVSS 9.8), this
An issue was discovered in dotCMS through 3.6.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated atta
SQL injection in dotCMS Core (versions 25.11.04-1 through 26.04.28-02) lets remote unauthenticated attackers read, modif
dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. Rated critical severity (
SQL injection vulnerability in the "Site Browser > HTML pages" screen in dotCMS before 3.3.1 allows remote authenticated
SQL injection vulnerability in the "Site Browser > Links pages" screen in dotCMS before 3.3.1 allows remote authenticate
SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.3.1 allows remote authentic
SQL injection vulnerability in the JSONTags servlet in dotCMS before 3.3.1 allows remote authenticated attackers to exec
SQL injection vulnerability in the "Site Browser > Containers pages" screen in dotCMS before 3.3.1 allows remote authent
SQL injection vulnerability in the "Site Browser > Templates pages" screen in dotCMS before 3.3.1 allows remote authenti
dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter. Rated high seve
Exploit-DB