FeehiCMS CVE-2026-51953

Exploitation requires the attacker to first obtain a valid session token issued to a FeehiCMS account with elevated privileges (e.g., administrator). Token acquisition is the prerequisite gating condition - the CVSS AC:H metric reflects this requirement. Once a token is held, no further special configuration is needed: the flaw exists in a standard FeehiCMS 2.1.1 deployment. The logout handler's failure to destroy the server-side session record is the core exploitable condition, and this behavior is present by default in the affected version. Limiting factors include: the attacker cannot self-generate a valid token (must steal or intercept one), requiring a secondary attack vector or physical/network proximity; PR:N on the attacker's own account confirms no prior CMS credential is needed; and the absence of availability impact (A:N) indicates the attack is passive/impersonation in nature rather than disruptive.

The CVSS 7.4 High vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) signals network-reachable exploitation with no attacker credential required, but AC:H is a meaningful brake - the attacker must first acquire a valid session token belonging to a privileged user via a secondary method (interception, XSS, stolen cookie, etc.). This prerequisite substantially limits opportunistic mass exploitation. EPSS at 0.20% (10th percentile) aligns with this: very few observed exploitation attempts in the wild. No CISA KEV listing exists, so active exploitation is not confirmed. However, a public PoC/write-up exists (https://github.com/altamish1994/CVE_Published/blob/main/FeehiCMS/CVE-2026-51953.MD), which lowers the technical barrier for targeted attacks. The high C:H and I:H impact scores mean successful exploitation could yield full account takeover of the impersonated user. In practice, this is a real priority for any organization running FeehiCMS 2.1.1 with internet-exposed login pages, but the attack complexity and niche product footprint reduce systemic risk relative to the raw CVSS score.

An attacker intercepts a valid FeehiCMS session cookie from a privileged user - for example, via ARP spoofing on a shared network or by exploiting a related XSS flaw in the CMS - and stores the token. After the legitimate user logs out, the attacker submits an HTTP request to the CMS bearing the captured cookie; the server, having failed to invalidate the session, accepts it and grants access at the original user's privilege level. A public PoC write-up at https://github.com/altamish1994/CVE_Published/blob/main/FeehiCMS/CVE-2026-51953.MD documents this technique, reducing the required attacker skill.