PublicCMS CVE-2026-6796

The vulnerability is triggered whenever the log_login function in LoginAdminController.java processes a failed authentication attempt - a condition that occurs during any incorrect password submission to the admin login endpoint, requiring no authentication and no special CMS configuration. However, realizing the confidentiality impact (reading the stored plaintext password) requires the attacker to have read access to the application log files on disk, which typically means a local or low-privileged OS account, shared hosting access, or compromised credentials for a service with log access. Exploitation is constrained by: (1) needing filesystem or log-aggregation read access separate from the network trigger; (2) log rotation policies that may purge entries before retrieval; (3) the victim needing to have previously attempted a login with their real password, not just an arbitrary string. Default OS file permission hardening (log files readable only by the application service user) would prevent read-access exploitation even though the unsafe write still occurs.

The CVSS 4.0 score of 5.3 (Medium) accurately reflects a limited-impact flaw: AV:N confirms the trigger is network-reachable, but PR:L and VC:L indicate that credential recovery requires some existing privilege on the target system and yields only partial confidentiality exposure. EPSS at 0.01% (2nd percentile) signals essentially no observed weaponization. SSVC rates this Exploitation:none, Automatable:no, Technical Impact:partial - consistent with an opportunistic rather than systematic threat. The absence of a vendor advisory and the vendor's non-response to disclosure means no patched version is confirmed, which extends organizational exposure. In practice, risk is bounded by the requirement for log-file read access, making this most dangerous in shared-hosting or multi-tenant environments where log access controls are weak. This is not a high-priority emergency patch but warrants remediation planning given the indefinite log accumulation of plaintext credentials.

A low-privileged user on the same server - such as another web application's service account or a shell user - reads the PublicCMS application log directory after multiple failed login attempts have occurred (whether organic user errors or attacker-driven probing). The attacker extracts cleartext passwords from the log entries and replays them against the CMS admin panel or exploits credential reuse across other services. No public POC is available, but the technique requires no special tooling beyond log file read access.