What is the CVSS score of CVE-2026-35182?

CVE-2026-35182 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-35182?

Brave CMS versions 2.0.0 through 2.0.5 contain a critical privilege escalation vulnerability allowing any authenticated user to elevate themselves to Super Admin, resulting in complete platform…. A patch is available.

How to fix or mitigate CVE-2026-35182?

Within 24 hours: Identify all systems running Brave CMS 2.0.x and document current versions. Within 7 days: Upgrade all instances to Brave CMS 2.0.6 or later, and audit user access logs for the /rights/update-role endpoint to detect prior exploitation attempts. Within 30 days: Implement role-based access control reviews and conduct privilege attestation for all CMS administrator accounts.

PHP CVE-2026-35182

EUVD-2026-19458 HIGH

Missing Authorization (CWE-862)

2026-04-06 GitHub_M

PHP Authentication Bypass

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:06 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0.6

EUVD ID Assigned

Apr 06, 2026 - 19:30 euvd

EUVD-2026-19458

Analysis Generated

Apr 06, 2026 - 19:30 vuln.today

CVE Published

Apr 06, 2026 - 19:10 nvd

HIGH 8.8

DescriptionGitHub Advisory

Brave CMS is an open-source CMS. Prior to 2.0.6, this vulnerability is a missing authorization check found in the update role endpoint at routes/web.php. The POST route for /rights/update-role/{id} lacks the checkUserPermissions:assign-user-roles middleware. This allows any authenticated user to change account roles and promote themselves to Super Admin. This vulnerability is fixed in 2.0.6.

AnalysisAI

Privilege escalation in Brave CMS 2.0.x before 2.0.6 allows authenticated users with low-privilege accounts to promote themselves to Super Admin by directly calling the unprotected role update endpoint. The vulnerability stems from a missing authorization middleware check on the /rights/update-role/{id} route, enabling complete takeover of the CMS by any user with valid credentials. No public exploit identified at time of analysis, but exploitation is trivial given the straightforward API endpoint access. With EPSS data unavailable and no KEV listing, risk primarily affects organizations using affected Brave CMS versions in multi-user environments.

Technical ContextAI

Brave CMS is an open-source PHP-based content management system identified by CPE cpe:2.3:a:ajax30:bravecms-2.0. This vulnerability represents CWE-862 (Missing Authorization), a class of security weakness where an application fails to verify that a user has permission to perform a requested action. The root cause lies in the routes/web.php configuration file where the POST endpoint /rights/update-role/{id} was implemented without the checkUserPermissions:assign-user-roles middleware that enforces role-based access controls. Laravel and similar PHP frameworks typically use middleware chains to validate authorization before allowing access to sensitive operations. In this case, the missing middleware allows the request to proceed directly to the role update function without verifying whether the authenticated user has administrative privileges to modify role assignments. This architectural flaw is particularly critical because role management is a foundational security control in any multi-user system.

RemediationAI

Organizations running Brave CMS should immediately upgrade to version 2.0.6 or later, which includes the fix for this authorization bypass vulnerability. The patch adds the required checkUserPermissions:assign-user-roles middleware to the /rights/update-role/{id} endpoint, properly enforcing authorization checks before allowing role modifications. Download the patched release from the official Brave CMS GitHub repository at https://github.com/Ajax30/BraveCMS-2.0 and follow standard upgrade procedures including backing up the database and configuration files before applying updates. Review application logs for any suspicious role modification activity, specifically POST requests to /rights/update-role/ endpoints from non-administrative accounts, as indicators of potential exploitation prior to patching. If immediate patching is not feasible, implement a temporary workaround by manually adding authorization middleware to the vulnerable route in routes/web.php or by restricting network access to the administrative interface to trusted IP addresses only. Complete vendor advisory and remediation guidance is available at https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-g58h-mvjw-f4hv.