What is the CVSS score of CVE-2026-30452?

CVE-2026-30452 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Textpattern CMS CVE-2026-30452

EUVD-2026-24160 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 mitre

GHSA-px9m-396q-mg36

PHP Authentication Bypass

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 16:23 vuln.today

CVSS changed

Apr 22, 2026 - 16:22 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 21, 2026 - 17:00 euvd

EUVD-2026-24160

Analysis Generated

Apr 21, 2026 - 17:00 vuln.today

CVE Published

Apr 21, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to modify articles owned by users with higher privileges. By manipulating the article ID parameter during the duplicate-and-save workflow in textpattern/include/txp_article.php, an attacker can bypass authorization checks and overwrite content belonging to other users.

AnalysisAI

Textpattern CMS 4.9.0 allows authenticated low-privilege users to modify articles owned by higher-privilege users by manipulating the article ID parameter in the duplicate-and-save workflow, bypassing authorization checks in the article management system. The vulnerability affects only authenticated users with existing CMS access and requires no user interaction or special network access. No public exploit code or active exploitation has been identified, though the EPSS score of 0.02% suggests minimal real-world attack probability despite the moderate CVSS 6.5 score.

Technical ContextAI

Textpattern CMS is a PHP-based content management system. The vulnerability exists in textpattern/include/txp_article.php, specifically in the article duplication and save workflow. The root cause is a failure to properly validate authorization checks (CWE-284: Improper Access Control) when processing article ID parameters. The code does not sufficiently verify that the authenticated user has permission to modify the target article before allowing the duplicate-and-save operation to proceed. This is a classic privilege escalation flaw where authorization logic is either missing or bypassable through parameter manipulation in the article workflow handler.

RemediationAI

Upgrade Textpattern CMS to version 4.9.1 or later, which contains authorization check fixes for the article management workflow. The vendor advisory at textpattern.com/weblog/textpattern-491-released-security-fixes-patches-and-tweaks provides patch details and release notes. Organizations unable to upgrade immediately should implement compensating controls: restrict article management permissions to trusted administrators only by reviewing and tightening role-based access control settings in Textpattern's user management interface; disable the duplicate-and-save workflow for low-privilege users by modifying permissions in txp_article.php or disabling the feature entirely if not essential to your workflow; audit article modification logs to detect unauthorized content changes; and monitor for suspicious article ID parameters in HTTP requests to the article management interface. Be aware that restricting duplicate functionality may impact editorial productivity for contributors.