EUVD-2026-87081
GHSA-x6x4-g3x8-4p64
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Puput-based blog site
-
ExploitRequest blog index/archive/RSS endpoint
-
Executionget_entries() returns restricted posts
-
ImpactRead unpublished/restricted content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated HTTP access to any Puput (APSL) blog site running versions 1.2.1 through 2.2.0 is sufficient. Exploitation works against default configurations through the standard blog index, tag/category/author/date archive views, sidebar widgets, or the RSS feed, all of which call the flawed BlogPage.get_entries(). The only practical limiter is deployment scope: the target must host content that was actually marked restricted/unpublished (otherwise there is nothing extra to leak), and the site must run an affected Puput version. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a remotely reachable, low-complexity, unauthenticated confidentiality-only flaw - consistent with the description of unauthenticated read access to restricted blog entries. No EPSS score, no CISA KEV listing, and no explicitly-flagged POC are present in the input, so this is not confirmed to be under active exploitation; exploitation status is best treated as no public exploit confirmed, though a referenced GitHub gist (itsmohitnarayan) may contain a writeup or proof-of-concept and should be reviewed. The C:H rating appears somewhat generous: the impact is limited to disclosure of restricted/unpublished blog content rather than credentials, PII, or system data, so real-world severity is likely lower than the 7.5 headline suggests. Net: a genuinely trivial-to-trigger information-disclosure bug, but in a niche Django/Wagtail blogging application with limited deployment footprint, making it a low-to-medium operational priority rather than an urgent one. Key missing signals (EPSS, KEV, confirmed POC, precise affected-version metadata from EUVD which lists only 'n/a n/a') should be noted as gaps. |
| Exploit ScenarioDerived | An unauthenticated attacker simply browses the public blog index, tag/category/author/date archive pages, sidebar widgets, or the RSS feed of a Puput-powered site and receives blog entries that were intended to be restricted (e.g. unpublished or access-controlled posts), because BlogPage.get_entries() does not filter them out. No authentication, special tooling, or user interaction is required; a referenced gist may document the exact requests. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Unauthenticated access control weakness in APSL Puput 1.2.1 through 2.2.0 allows a remote visitor to read blog entries that the site intended to restrict, because BlogPage.get_entries() fails to enforce visibility checks in the blog index, tag/category/author/date archives, sidebar widgets, and RSS feed. Exploitation needs only network access to an affected Puput deployment (PR:N, AC:L), but our independent assessment rates the confidentiality impact as Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so practical data loss is limited to restricted content that actually exists on the target. No public exploit code or CISA KEV entry is identified in the provided data.
RemediationAI
No vendor-released patch or fixed version is identified in the provided references, so the primary action is to monitor NVD/EUVD for a Puput update and upgrade immediately once a patched release beyond 2.2.0 is published. Until then, apply a code-level hotfix that overrides BlogPage.get_entries() to exclude entries not permitted for the requesting context, or use a custom BlogPage/queryset that re-applies the intended restriction filter before any archive, widget, or feed renders; test carefully because an incorrect filter may hide legitimate public posts. As tactical compensating controls, disable or block the affected public surfaces-blog index, tag/category/author/date archive routes, sidebar widgets that call get_entries(), and the RSS feed (often /feed/ or /rss/) - at the reverse proxy or URL configuration, and require authentication for those paths; the trade-off is loss of public syndication, SEO/navigation, and possibly the entire public blog. Review the advisory references at https://nvd.nist.gov/vuln/detail/CVE-2026-88421 and the linked EUVD advisory for updated remediation details.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
APSL Puput is a Django/Wagtail-based blog application; BlogPage.get_entries() is the queryset helper that supplies entries to many public-facing views and widgets. CWE-284 (Improper Access Control) manifests because the helper does not filter out entries intended to be restricted or otherwise gated, so every caller-blog index, tag/category/author/date archive, sidebar, RSS-inherits the same overly broad result set. The issue is a broken authorization/visibility check, not an injection or memory-safety bug; exploitation is unauthenticated over HTTP against default configurations. NVD's supplied vector (7.5, C:H) reflects a high confidentiality view, while our authoritative assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (confidentiality Low, no integrity or availability impact).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Trivially remote and unauthenticated (AV:N/AC:L/PR:N/UI:N), confidentiality-only; C:L rather than C:H because impact is limited to restricted blog content, not sensitive system/credential data.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed.
Executive ViewAI
APSL Puput versions 1.2.1 through 2.2.0 contain an unauthenticated access control weakness that allows remote visitors to read restricted blog entries. Organizations using these versions for internal or confidential blogs face potential exposure of sensitive information to unauthorized users. Leadership should prioritize mitigation because the flaw is easily exploitable and affects confidentiality of restricted content.
No vendor-released patch identified at time of analysis. Restrict network access to Puput deployments, implement additional access controls at the reverse proxy to enforce visibility, monitor logs for unauthorized access to restricted entries, and consider temporarily disabling affected features such as RSS feeds or archives.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB