What is the CVSS score of CVE-2026-39169?

CVE-2026-39169 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of SEMCMS are affected by CVE-2026-39169?

SEMCMS 5.0 contains an unauthenticated access vulnerability (CVE-2026-39169) enabling remote attackers to reach sensitive administrative functionality without credentials, with no public exploit…

How to fix or mitigate CVE-2026-39169?

Within 24 hours: Conduct inventory of all SEMCMS 5.0 installations; implement firewall rules to restrict network access to the SEMCMS_copy.php endpoint; enable detailed HTTP request logging for this endpoint. Within 7 days: Deploy reverse-proxy authentication or Web Application Firewall rules requiring credentials to access the endpoint; analyze access logs for signs of unauthorized attempts. Within 30 days: Monitor SEMCMS vendor security advisories for patch releases; develop upgrade or remediation plan if patch timeline exceeds 90 days; evaluate migration to alternative CMS solutions if necessary.

SEMCMS CVE-2026-39169

HIGH

Improper Access Control (CWE-284)

2026-06-09 mitre

PHP Authentication Bypass N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:29 vuln.today

CVSS changed

Jun 09, 2026 - 21:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMS_copy.php.

AnalysisAI

Unauthorized access in SEMCMS 5.0 allows remote attackers to reach the SEMCMS_copy.php endpoint without authentication, exposing sensitive functionality intended to be restricted. The CVSS 7.5 score reflects high confidentiality impact with no integrity or availability effect, and no public exploit identified at time of analysis beyond a referenced gist. The flaw stems from improper access control (CWE-284) in a PHP-based content management system.

Technical ContextAI

SEMCMS is a PHP-based multilingual content management system commonly deployed for small business and e-commerce websites. The vulnerable component, SEMCMS_copy.php, is an administrative script that lacks proper authorization checks, an instance of CWE-284 (Improper Access Control). In well-designed PHP CMS applications, every administrative script should validate session state or token-based authentication before executing privileged operations; here, that gate is missing or bypassable, allowing direct HTTP requests to reach functionality that should be gated behind an authenticated admin session. The provided CPE string is a placeholder (cpe:2.3:a:n/a:n/a:*) and does not authoritatively bind the issue to a specific vendor namespace in NVD.

RemediationAI

No vendor-released patch identified at time of analysis. Until the SEMCMS maintainer publishes a fixed release, operators should restrict access to SEMCMS_copy.php at the web server layer - for example, by adding an Nginx or Apache location block that denies external access and only permits requests from trusted admin IP ranges, with the trade-off that legitimate remote administration will require VPN or jump-host access. A web application firewall rule blocking direct requests to /SEMCMS_copy.php from unauthenticated sessions is an alternative compensating control. As a deeper mitigation, audit the file to add an explicit session/authentication check at the top of the script before any logic executes, accepting that this is a local code modification that will be overwritten by future upstream updates. The referenced gist (https://gist.github.com/ql288470-pixel/c30caddaa3204d49d82317bb92bffa43) should be reviewed for additional technical detail on the exact request shape to block.