EUVD-2026-51653
GHSA-jhhh-39pj-vgq6
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
AC:H reflects mandatory prior token acquisition via secondary vector; PR:N correct as attacker needs no own CMS credential; A:N as attack is impersonation only.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components
AnalysisAI
Privilege escalation in FeehiCMS v.2.1.1 exploits insufficient session expiration (CWE-613) across the session management module, authentication logic, and logout handler, allowing a network-based attacker to reuse captured session tokens even after legitimate user logout to gain elevated access. The CVSS 3.1 score of 7.4 (High) reflects high confidentiality and integrity impact under high attack complexity, with no authentication required on the attacker's side. A public proof-of-concept write-up exists on GitHub; however, EPSS sits at 0.20% (10th percentile) and no CISA KEV listing exists, suggesting limited observed exploitation despite available exploit documentation.
Technical ContextAI
FeehiCMS is a PHP-based content management system (source at https://github.com/liufee/cms). The vulnerability is rooted in CWE-613 (Insufficient Session Expiration), a class of flaw where server-side session records are not invalidated when a user logs out - meaning the session token remains valid on the server even after the client is told to discard it. The flaw spans three components: the session management module (token lifecycle), authentication logic (session-to-identity binding), and the logout handler (which apparently fails to destroy the server-side session record). An attacker who possesses a previously issued session token can replay it post-logout and impersonate the original user at whatever privilege level that user held. The NVD CPE entry is listed as cpe:2.3:a:n/a:n/a, indicating NVD had not completed formal product mapping at the time of analysis. The EUVD entry EUVD-2026-51653 corroborates the CVE but similarly lacks a resolved CPE.
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis. Operators should monitor the upstream repository at https://github.com/liufee/cms for any commits or releases addressing session invalidation. As compensating controls: enforce server-side session destruction on logout by deleting the session record from the datastore (not merely clearing the client-side cookie), which directly closes the replay window but requires a code change. Implement short absolute session lifetimes (e.g., 30-60 minutes) to limit the replay window; this may inconvenience long-session workflows. Set session cookies with the HttpOnly and Secure flags to reduce token exposure via JavaScript or plaintext HTTP, though this does not address the server-side invalidation gap. Restrict the CMS administrative interface to trusted IP ranges or a VPN to reduce the attacker's ability to deliver a replayed token from an external network. None of these controls eliminate the root flaw - a code-level fix to the logout handler is required.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today