October CMS EUVD-2026-24159

This vulnerability requires: (1) Authenticated backend user account with editor role or equivalent access; (2) Uncommon permission configuration where the user is explicitly granted editor access but has editor.cms_assets or editor.tailor_blueprints sub-permissions specifically and intentionally withheld; (3) Access to the CMS or Tailor editor interface in the backend administrative panel. Standard permission configurations where editors either possess full asset/blueprint permissions or are denied editor access entirely are not vulnerable. The vulnerability does NOT affect frontend users, unauthenticated requests, or installations using default or typical role-based access control patterns where permission restrictions are applied at the role level rather than as mixed individual sub-permission grants.

The CVSS score of 3.3 with vector AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N indicates low severity with multiple limiting factors: high attack complexity (AC:H), requirement for high-level privileges (PR:H), and limited impact (confidentiality and integrity low, no availability impact). Real-world risk is significantly constrained by the extremely uncommon permission configuration required-this only affects installations where administrators have explicitly granted editor access while simultaneously withholding specific sub-permissions, which contradicts typical role-based access control design patterns. The attack requires authenticated backend access and elevated privileges, making it an insider threat rather than a general-population risk. No public exploit code has been identified, and CISA KEV status has not been provided. While the vulnerability is genuine, the narrow attack surface (uncommon configuration + high privileges required + network complexity) suggests this represents a lower practical risk than the CVSS number alone implies. Organizations with standard permission models where editors either have asset/blueprint permissions or do not (without mixed-state configurations) are not affected.

A malicious backend user with editor access to a portion of the CMS (e.g., content editing) but whose permissions explicitly exclude asset and blueprint management attempts to upload a malicious theme asset or blueprint file. Due to the missing sub-permission check, the file operation succeeds despite the configured permission denial, allowing the attacker to inject malicious code into theme files or blueprint definitions that execute on subsequent site rendering or administration actions.