Which versions of PHP are affected by CVE-2026-4514?

Organizations using PbootCMS should be aware of moderate risk from CVE-2026-4514, a improper access control vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4514?

Yes, a public proof-of-concept exploit is available for CVE-2026-4514. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4514?

Within 30 days: Identify affected systems running PbootCMS and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-4514

Q: What is the CVSS score of CVE-2026-4514?

CVE-2026-4514 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14248 LOW

Improper Access Control (CWE-284)

2026-03-21 VulDB

PHP Authentication Bypass Pbootcms N A

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVSS changed

Apr 24, 2026 - 16:37 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 21, 2026 - 11:00 euvd

EUVD-2026-14248

Analysis Generated

Mar 21, 2026 - 11:00 vuln.today

CVE Published

Mar 21, 2026 - 10:32 nvd

MEDIUM 6.3

DescriptionCVE.org

A flaw has been found in PbootCMS up to 3.2.12. Affected by this issue is some unknown functionality of the file apps/admin/controller/system/UserController.php of the component Backend. Executing a manipulation of the argument Field can lead to improper access controls. The attack may be performed from remote. The exploit has been published and may be used.

AnalysisAI

PbootCMS versions up to 3.2.12 contain an improper access control vulnerability in the Backend UserController component that allows authenticated attackers to manipulate the Field argument and bypass access restrictions. An attacker with login credentials can exploit this to gain unauthorized access to sensitive user data or system functions. A proof-of-concept exploit has been publicly disclosed on GitHub and the vulnerability carries a moderate CVSS score of 6.3 with documented exploitation capability.

Technical ContextAI

The vulnerability exists in the PHP-based PbootCMS application, specifically in the file apps/admin/controller/system/UserController.php within the Backend component. The root cause is classified as CWE-284 (Improper Access Control), indicating a failure to properly validate or enforce authorization checks on user-supplied input. When an authenticated user manipulates the Field parameter, the application fails to validate whether the requester has authorization to modify that particular field, allowing horizontal or vertical privilege escalation. The vulnerability is specific to the administrative backend interface and affects how user record modifications are processed.

RemediationAI

Immediately upgrade PbootCMS to the latest version beyond 3.2.12 that includes the access control fix. Consult the official PbootCMS security advisories and release notes to identify the patched version. Until an upgrade is feasible, implement the following interim controls: restrict Backend administrative access to a minimal set of trusted IP addresses using network-level firewall rules, enforce strong authentication policies and consider multi-factor authentication for administrative accounts, regularly audit Backend user modification logs for unauthorized field changes, and segment administrative accounts by role to limit the impact of any single compromised account. Review the GitHub proof-of-concept linked in the CVE references to understand the specific field manipulation technique and implement input validation rules accordingly if custom patching is necessary before official patches are available.