EUVD-2026-51293
GHSA-xv6g-v6rg-vw4p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable controller exploitable by any authenticated non-admin (PR:L, AC:L, no UI); backup create/download/restore yields full confidentiality, integrity, and availability impact within the same app scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the incorrect evaluation of the access control expression to create, download, and restore backups without administrative privileges.
AnalysisAI
Privilege escalation via authorization bypass in Wolf CMS (through 0.8.3.1) lets any authenticated non-administrative user reach the BackupRestoreController and create, download, and restore site backups that should be admin-only. The root cause is a PHP operator-precedence mistake in the permission-check expression, so the access control evaluates incorrectly and grants low-privileged accounts admin-tier backup functionality. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated Wolf CMS account at any non-administrative privilege level (PR:L) that can reach the BackupRestoreController over the network (AV:N); no admin role, user interaction, or special attack requirement is needed against a default installation because the flawed operator-precedence check misgrants access regardless of the user's actual role. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H) scores 8.7 (High) and is internally consistent with the description: network-reachable, low attack complexity, no user interaction, but requiring an existing low-privileged authenticated account (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or is granted an ordinary low-privileged Wolf CMS account, then sends a normal HTTP request directly to the BackupRestoreController backup endpoint. Because the mis-parenthesized permission check evaluates incorrectly, the request is authorized, letting the attacker create and download a full backup (exfiltrating site content and database) and restore arbitrary backup data to tamper with the site. … |
| Remediation | No vendor-released patch version was identified in the provided data, so no fixed release can be cited with confidence; monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/wolf-cms-authorization-bypass-via-backuprestorecontroller) and the Wolf CMS project for an update, and if a corrected build is published, upgrade to it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Wolf CMS instances and disable or restrict access to BackupRestoreController for non-administrative accounts using reverse proxy or web application firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-697 – Incorrect Comparison
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today