Is there a public PoC exploit available for CVE-2026-9376?

Yes, a public proof-of-concept exploit is available for CVE-2026-9376. Prioritise patching immediately. EPSS: 0.0%.

JPress CVE-2026-9376

Q: What is the CVSS score of CVE-2026-9376?

CVE-2026-9376 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31590 LOW

Improper Authorization (CWE-285)

2026-05-24 VulDB

GHSA-v6rp-6x79-xm3w

Authentication Bypass Jpress

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:56 vuln.today

Severity Changed

May 26, 2026 - 20:07 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 20:07 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was determined in JPress up to 1.0.3. The affected element is an unknown function of the file /ucenter/article/doWriteSave of the component UCenter Article Submission Endpoint. Executing a manipulation of the argument id/userId can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Improper authorization in JPress versions 1.0.0 through 1.0.3 allows any authenticated low-privilege user to manipulate the id and userId parameters at the /ucenter/article/doWriteSave UCenter endpoint, potentially reading or overwriting article data belonging to other users. Publicly available exploit code exists (disclosed via GitHub issue #194), though EPSS sits at 0.03% (10th percentile) and SSVC classifies current exploitation status as 'none,' indicating limited real-world uptake despite the public disclosure. The vendor has not responded to responsible disclosure and no patch has been released.

Technical ContextAI

JPress is a Java-based open-source CMS platform. The vulnerable endpoint /ucenter/article/doWriteSave handles article write and save operations within the UCenter user portal. The root cause is CWE-285 (Improper Authorization): the application accepts user-supplied id and userId parameters without verifying that the authenticated session's identity matches the resource being acted upon - a classic Insecure Direct Object Reference (IDOR) pattern where authorization is enforced at login but not at the per-resource level. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable exploitation with low complexity requiring only a low-privilege account and no user interaction. The CPE identifier cpe:2.3:a:n/a:jpress:*:*:*:*:*:*:*:* reflects limited vendor namespace normalization in NVD for this package. The E:P modifier in the CVSS vector independently corroborates that proof-of-concept exploit code exists.

RemediationAI

No vendor-released patch has been identified at time of analysis - the JPress project was notified through responsible disclosure but has not responded. Organizations should monitor the GitHub issue at https://github.com/JPressProjects/jpress/issues/194 for an upstream fix and apply it as the primary remediation when released. As a compensating control, deploy a WAF or reverse proxy rule that validates the userId parameter in requests to /ucenter/article/doWriteSave against the authenticated session identity, rejecting any mismatch before the request reaches the application layer; note this introduces operational overhead and requires session context visibility at the proxy level. Alternatively, restrict access to the UCenter article submission endpoint to trusted network segments or authenticated roles with verified identity binding, accepting the trade-off of reduced self-service functionality. Enable logging and alerting on requests to this endpoint where id or userId values differ from the session owner's identity to support detection without blocking. None of these workarounds resolve the root authorization defect without source-level code changes.