EUVD-2026-21384Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass authorization validation and gain full application control, circumventing restrictions on SuperAdmin account creation and privilege assignment.
AnalysisAI
Privilege escalation in CouchCMS allows authenticated Admin-level users to create SuperAdmin accounts by manipulating the f_k_levels_list parameter during user creation requests. Attackers modify the parameter value from 4 to 10 in HTTP POST bodies to bypass authorization controls and gain unrestricted application access. This authenticated attack (PR:H) enables lateral privilege movement from Admin to SuperAdmin, circumventing intended role hierarchy enforcement. Publicly available exploit code exists, lowering exploitation barrier for actors with existing Admin credentials.
Technical ContextAI
Root cause lies in insufficient server-side validation of privilege assignment parameters (CWE-639: Authorization Bypass Through User-Controlled Key). The application trusts client-supplied f_k_levels_list values without verifying current user authority to assign SuperAdmin privileges, enabling horizontal privilege escalation through parameter tampering in user management functions.
RemediationAI
Apply vendor-released security patch when available from https://www.couchcms.com/. No vendor-released patch identified at time of analysis; monitor official CouchCMS repository and security announcements for updates. Implement immediate compensatory controls: restrict Admin role assignment to trusted personnel only, enable comprehensive audit logging for all user creation and privilege modification events, implement mandatory multi-person approval workflows for administrative account creation, and deploy web application firewall rules to detect f_k_levels_list parameter manipulation attempts. Review existing user accounts for unauthorized SuperAdmin privileges created through this vector. Detailed technical analysis and proof-of-concept available at https://gist.github.com/thepiyushkumarshukla/477e2d2bbbe8cc3ec0d640c50f0cf9e1 and vendor advisory at https://www.vulncheck.com/advisories/couchcms-privilege-escalation-via-f-k-levels-list-parameter.
** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via t
An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows attackers to redirect a victim us
CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrar
Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.fun
CouchCMS 2.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary Ja
CouchCMS versions up to 2.4 use hard-coded cryptographic keys in the reCAPTCHA handler configuration, allowing remote at
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today