EUVD-2026-21384Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Admin user
-
DeliveryIntercept user creation HTTP request
-
ExploitModify f_k_levels_list parameter from 4 to 10
-
ExecutionBypass authorization validation
-
PersistCreate SuperAdmin account
-
ImpactGain full application control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires authenticated Admin-level user account in CouchCMS. Attacker must intercept and modify the f_k_levels_list HTTP request parameter from value 4 to 10 during user creation to create SuperAdmin accounts and bypass authorization restrictions. |
| Impact | High-impact privilege escalation requiring authenticated Admin access. CVSS 7.2 reflects high confidentiality, integrity, and availability impact. Unauthenticated attackers cannot exploit this directly, limiting blast radius to insider threats or compromised Admin accounts. Publicly available exploit code exists, elevating operational risk for unpatched CouchCMS instances. Priority depends on Admin account exposure. |
| Exploit ScenarioDerived | Authenticated Admin obtains valid session token. Attacker modifies f_k_levels_list parameter from 4 to 10 in user creation HTTP request body, bypassing authorization validation. Malicious SuperAdmin account created with full application control. Publicly available exploit code exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Privilege escalation in CouchCMS allows authenticated Admin-level users to create SuperAdmin accounts by manipulating the f_k_levels_list parameter during user creation requests. Attackers modify the parameter value from 4 to 10 in HTTP POST bodies to bypass authorization controls and gain unrestricted application access. This authenticated attack (PR:H) enables lateral privilege movement from Admin to SuperAdmin, circumventing intended role hierarchy enforcement. Publicly available exploit code exists, lowering exploitation barrier for actors with existing Admin credentials.
RemediationAI
Apply vendor-released security patch when available from https://www.couchcms.com/. No vendor-released patch identified at time of analysis; monitor official CouchCMS repository and security announcements for updates. Implement immediate compensatory controls: restrict Admin role assignment to trusted personnel only, enable comprehensive audit logging for all user creation and privilege modification events, implement mandatory multi-person approval workflows for administrative account creation, and deploy web application firewall rules to detect f_k_levels_list parameter manipulation attempts. Review existing user accounts for unauthorized SuperAdmin privileges created through this vector. Detailed technical analysis and proof-of-concept available at https://gist.github.com/thepiyushkumarshukla/477e2d2bbbe8cc3ec0d640c50f0cf9e1 and vendor advisory at https://www.vulncheck.com/advisories/couchcms-privilege-escalation-via-f-k-levels-list-parameter.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause lies in insufficient server-side validation of privilege assignment parameters (CWE-639: Authorization Bypass Through User-Controlled Key). The application trusts client-supplied f_k_levels_list values without verifying current user authority to assign SuperAdmin privileges, enabling horizontal privilege escalation through parameter tampering in user management functions.
Know when Couchcms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass authorization validation and gain full application control, circumventing restrictions on SuperAdmin account creation and privilege assignment.
Executive ViewAI
CouchCMS contains a privilege escalation vulnerability affecting authenticated administrators who can exploit a parameter manipulation flaw to create SuperAdmin accounts, effectively bypassing role-based access controls. Organizations running CouchCMS with multiple administrative users face immediate risk of unauthorized elevation to unrestricted system access, potentially enabling data exfiltration, system compromise, or malicious configuration changes by insider threats or compromised admin accounts.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce principle of least privilege by limiting Admin account distribution to critical personnel only; (2) Implement Web Application Firewall rules to detect and block POST requests containing f_k_levels_list parameter values outside normal range (4); (3) Enable comprehensive audit logging on all user creation and role modification operations; (4) Restrict network access to CouchCMS administrative interfaces using IP whitelisting or VPN requirements; (5) Monitor for creation of SuperAdmin accounts via real-time alerting on user privilege escalation events.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via t
An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows attackers to redirect a victim us
CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrar
Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.fun
CouchCMS 2.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary Ja
CouchCMS versions up to 2.4 use hard-coded cryptographic keys in the reCAPTCHA handler configuration, allowing remote at
Exploit-DB