YznCMS EUVD-2026-114736

Exploitation requires an existing authenticated backend session with high privileges (PR:H) on the YznCMS admin panel; the attacker must be able to reach and invoke the Backend function of app/admin/controller/auth/Group.php (the Auth Group Handler). This is not exploitable by unauthenticated or anonymous users - the high-privilege authentication requirement is the primary limiting factor, confining the threat to malicious or compromised privileged backend accounts rather than external anonymous attackers. The specific configuration or input that triggers the improper privilege management is not detailed in the available sources. Affected versions are up to and including 2.2.0; upgrading to 2.2.1 remediates the issue.

This is a medium-severity issue (CVSS 4.0 base 5.1) that does not rise to a top priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) indicates network reachability and low attack complexity, but critically requires high privileges (PR:H), meaning the attacker must already be an authenticated, privileged backend user before touching the vulnerable Auth Group handler. Impact is uniformly low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no scope change (SC:N/SI:N/SA:N), so even successful exploitation yields limited gain - consistent with an improper-privilege-management (CWE-269) flaw that likely lets an already-privileged backend account escalate or manipulate authorization groups beyond intent. No EPSS score is provided, so exploitation probability cannot be quantified. The issue is not on the CISA KEV list and there is no public exploit identified at time of analysis - the references are VulDB catalog/CTI pages and the vendor patch, not working exploit code. The vuln.today decision label is 'this_month', not act_now or emergency, aligning with a patch-in-routine-cycle posture rather than urgent response. Note the PR:H requirement meaningfully constrains real-world risk despite the network attack vector: this is an insider/post-authentication privilege problem, not a pre-auth remote takeover.

An attacker who already holds an authenticated backend account on a YznCMS (≤2.2.0) instance invokes the Backend function in app/admin/controller/auth/Group.php to manipulate auth-group assignments, improperly altering privileges beyond what their role should permit. The request is made remotely over the network against the admin interface, but no unauthenticated access is possible. No public exploit code has been identified, and the precise trigger mechanism within the function is not described in the available sources.