EUVD-2026-75231
GHSA-22m5-jm3v-fxq8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable authenticated exploit with only low integrity impact; no confidentiality or availability loss, no scope change.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
3DescriptionCVE.org
BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may be altered by an attacker who can log in to the product may be caused.
AnalysisAI
Authorization bypass in BurgerEditor 3.0.0 through 3.4.0 allows authenticated low-privileged users to alter page content outside their permitted scope by manipulating user-controlled key parameters. Rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), the flaw permits any logged-in user to substitute a legitimate resource identifier with one belonging to another user or content area, bypassing ownership checks server-side. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess a valid, authenticated BurgerEditor account (CVSS PR:L confirms authentication is required; unauthenticated external attackers cannot exploit this flaw). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 Medium score is consistent with the exploitation profile: the attack requires a valid, authenticated account (PR:L), produces only low-level integrity impact (I:L), and has no confidentiality or availability dimension. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade BurgerEditor to a version beyond 3.4.0 as directed by the vendor advisory at https://burger.d-zero.co.jp/blogs/archives/3; consult that page directly to confirm the exact patched release version, as it was not independently specified in the provided intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Burgereditor
View allShare
External POC / Exploit Code
Leaving vuln.today