Movable Type CVE-2026-44392

Q: What is the CVSS score of CVE-2026-44392?

CVE-2026-44392 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31066 MEDIUM

Missing Authorization (CWE-862)

2026-05-20 jpcert

GHSA-98gq-cq48-6gcm

Authentication Bypass Movable Type Movable Type Advanced Movable Type Premium Movable Type Premium Advanced Edition

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 20, 2026 - 07:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

May 20, 2026 - 07:01 vuln.today

DescriptionCVE.org

Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed.

AnalysisAI

Missing authorization in Movable Type allows authenticated non-administrator users to trigger unintended update operations under certain conditions. Affecting Movable Type, Movable Type Advanced, and Movable Type Premium products by Six Apart Ltd., the flaw (CWE-862) permits a low-privileged user to bypass access controls and perform write operations that should be restricted to administrators. No public exploit or CISA KEV listing exists at time of analysis; the vendor released a fix in version 9.0.8 on 2026-05-20 per the Six Apart advisory.

Technical ContextAI

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the application fails to perform an authorization check before executing a sensitive update operation. Movable Type is a content management system (CMS) developed by Six Apart Ltd. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms the flaw is reachable over the network by a low-privileged authenticated user with no additional complexity or user interaction required. Affected product lines - confirmed via CPE strings - include Movable Type (cpe:2.3:a:six_apart_ltd.:movable_type), Movable Type Advanced (cpe:2.3:a:six_apart_ltd.:movable_type_advanced), and Movable Type Premium (cpe:2.3:a:six_apart_ltd.:movable_type_premium). The root cause is a server-side enforcement gap: the application does not verify that the authenticated session holds administrator-level privileges before processing the update request.

RemediationAI

The primary remediation is to upgrade to Movable Type 9.0.8 or later, released by Six Apart Ltd. on 2026-05-20 and announced at https://movabletype.org/news/2026/05/mt-908-released.html. This applies to all three affected product lines: Movable Type, Movable Type Advanced, and Movable Type Premium. If an immediate upgrade is not feasible, a practical compensating control is to audit and restrict non-administrator user accounts - removing or suspending accounts for users who do not require regular access, reducing the pool of potential attackers. Additionally, access to the Movable Type administrative interface should be restricted by IP allowlist or network perimeter controls (e.g., VPN-only access) to limit who can authenticate at all, thereby reducing the attack surface until patching is complete. Note that IP-based restrictions may disrupt legitimate remote contributors. The JVN advisory at https://jvn.jp/en/jp/JVN66473735/ should be consulted for any vendor-recommended interim mitigations.