Which versions of Serendipity are affected by EUVD-2026-51127?

Serendipity PHP blogging platform versions before 2.6.1 contain an account takeover vulnerability (CVSS 8.7) that allows Editor-level users to assume full Administrator rights, creating risk of data…. A patch is available.

How to fix or mitigate EUVD-2026-51127?

Within 24 hours, conduct a complete inventory of Serendipity deployments to identify versions before 2.6.1 and audit all Editor-level user accounts currently active. Within 7 days, restrict Editor role assignment to trusted personnel only, implement audit logging for all administrative account changes, disable Editor account self-registration, and establish daily monitoring for suspicious privilege escalation attempts. Within 30 days, establish regular contact with the Serendipity project to track patch availability for version 2.6.1, develop and test an upgrade plan for your deployment environment, and prepare for rapid deployment once the patched version is publicly released.

Serendipity EUVD-2026-51127

Q: What is the CVSS score of EUVD-2026-51127?

EUVD-2026-51127 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-67351 HIGH

Missing Critical Step in Authentication (CWE-304)

2026-07-30 VulnCheck

Information Disclosure Serendipity S9Y

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network login flow (AV:N/AC:L), requires an existing Editor account so PR:L not PR:N, no user interaction, and admin takeover yields full C/I/A impact within the same system (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 30, 2026 - 15:03 EUVD

Analysis Generated

Jul 30, 2026 - 14:51 vuln.today

CVE Published

Jul 30, 2026 - 13:57 cve.org

HIGH 8.7

DescriptionCVE.org

Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with an Administrator account and obtain administrative privileges by logging in with their own password while the session loads the Administrator's account data.

AnalysisAI

Privilege escalation in the Serendipity (s9y) PHP blogging platform before 2.6.1 lets an authenticated Editor take over an Administrator account by exploiting an authentication context confusion (CWE-304): password checking and session loading resolve the user independently rather than binding to a single record. By registering a username that collides with an Administrator's, the Editor logs in with their own password yet has the Administrator's account loaded into their session, inheriting full admin rights. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 8.7 reflects high confidentiality, integrity, and availability impact.

Technical ContextAI

Serendipity is an open-source PHP-based weblog/CMS maintained by the s9y project (CPE cpe:2.3:a:s9y:serendipity). The flaw is CWE-304, a missing critical step in authentication: the login flow validates the submitted password against one user record while a separate step loads session/account data by username, and the two operations are never verified to reference the same underlying user. Because usernames are treated as the linkage key without enforcing a single authoritative identity through the whole flow, a duplicate username causes the password of the attacker's own record to authenticate a session that is subsequently populated with the collided (Administrator) account. This is fundamentally a broken-authentication logic bug rather than a memory-safety or injection issue, and it hinges on the platform permitting username collisions across accounts of differing privilege.

RemediationAI

Vendor-released patch: 2.6.1 - upgrade all Serendipity installations to 2.6.1 or later, which enforces that password validation and session loading resolve to the same user record and prevents privilege-inheriting username collisions; see the vendor advisory GHSA-v645-243f-jwgh (https://github.com/s9y/Serendipity/security/advisories/GHSA-v645-243f-jwgh) and the VulnCheck writeup (https://www.vulncheck.com/advisories/serendipity-authentication-bypass-via-username-collision). If immediate patching is not possible, audit the user table for duplicate or near-duplicate usernames and remove any collisions with Administrator accounts, restrict or suspend the ability of Editor-level users to create or rename accounts, and limit who holds Editor privileges - trade-off: this constrains legitimate multi-author workflows and does not fully close the logic flaw, so it is a stopgap only until 2.6.1 is deployed.