What is the CVSS score of CVE-2026-35183?

CVE-2026-35183 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-35183?

Brave CMS versions prior to 2.0.6 contain an insecure direct object reference vulnerability that allows authenticated users with edit permissions to delete article images belonging to other users,…. A patch is available.

How to fix or mitigate CVE-2026-35183?

Within 24 hours: Identify all Brave CMS instances and document current versions. Within 7 days: Upgrade all Brave CMS deployments to version 2.0.6 or later, and restrict edit permissions to only trusted staff pending patching. Within 30 days: Conduct audit of image deletion logs for unauthorized access patterns and restore deleted images from backups if available.

PHP CVE-2026-35183

EUVD-2026-19460 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-06 GitHub_M

PHP Authentication Bypass

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:06 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0.6

EUVD ID Assigned

Apr 06, 2026 - 19:30 euvd

EUVD-2026-19460

Analysis Generated

Apr 06, 2026 - 19:30 vuln.today

CVE Published

Apr 06, 2026 - 19:11 nvd

HIGH 7.1

DescriptionGitHub Advisory

Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the article image deletion feature. It is located in app/Http/Controllers/Dashboard/ArticleController.php within the deleteImage method. The endpoint accepts a filename from the URL but does not verify ownership. This allows an authenticated user with edit permissions to delete images attached to articles owned by other users. This vulnerability is fixed in 2.0.6.

AnalysisAI

Authenticated users in Brave CMS can delete arbitrary article images belonging to other users via an Insecure Direct Object Reference (IDOR) flaw in versions prior to 2.0.6. The deleteImage method in ArticleController.php accepts filenames without verifying ownership, allowing any authenticated user with edit permissions to delete images from articles they don't own. CVSS 7.1 reflects high integrity impact with low availability impact. No public exploit identified at time of analysis, and EPSS data not available for this recent vulnerability.

Technical ContextAI

This is a classic Insecure Direct Object Reference (IDOR) vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) in a PHP-based content management system. The flaw resides in the article image deletion endpoint within app/Http/Controllers/Dashboard/ArticleController.php. The deleteImage method accepts a filename parameter directly from the URL without implementing proper authorization checks to verify that the requesting user owns or has rights to the referenced article. In secure implementations, such endpoints should validate that the authenticated session user has ownership or explicit permissions for the resource being modified. The affected product is BraveCMS-2.0, an open-source CMS written in PHP, as identified by CPE cpe:2.3:a:ajax30:bravecms-2.0. The vulnerability classification under CWE-639 indicates the system uses a user-controlled key (the filename) to access objects without proper authorization enforcement, a common anti-pattern in web applications that rely solely on authentication without granular authorization checks.

RemediationAI

Upgrade to Brave CMS version 2.0.6 or later, which contains the fix for this IDOR vulnerability. The vendor has released a patch that implements proper authorization checks in the deleteImage method to verify ownership before allowing image deletion. Installation administrators should update immediately by pulling the latest release from the GitHub repository at https://github.com/Ajax30/BraveCMS-2.0. Review the security advisory at https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-cpf3-fxwg-cwr3 for specific upgrade instructions. As a temporary workaround if immediate patching is not feasible, restrict edit permissions to only fully trusted users and implement file system monitoring to detect unauthorized image deletions, though upgrading to version 2.0.6 is the only complete remediation. After patching, audit application logs for suspicious deleteImage requests to identify potential exploitation attempts prior to the fix.