Subrion CMS EUVD-2026-85759

Requires network reachability to a Subrion CMS instance (<=4.2.1) and the ability to invoke the /actions.json endpoint with action=assign-owner and a manipulated q parameter. VulDB rates it PR:N (no authentication) and UI:N (no user interaction), meaning default remote access with no victim interaction; however, the 'assign-owner' action is an administrative content-ownership operation, so in real deployments a valid authenticated (likely admin/operator) session may in fact be required - a key limiting factor that should be verified. Impact is limited to confidentiality (VC:L): partial disclosure of owner/user information, not full database or credential compromise. Further limiting factors: the product is niche and largely unmaintained, so exposed internet-facing instances are relatively few, and no patch exists so mitigation depends on access controls or WAF filtering.

Real-world risk is LOW-to-MODERATE despite the 5.5 CVSS 4.0 score. The vendor-supplied vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) describes a remote, low-complexity, unauthenticated attack yielding only limited confidentiality impact (VC:L) with no integrity or availability effect - consistent with CWE-200 information disclosure. Exploit maturity is E:P (proof-of-concept), matching the POC=YES signal: publicly available exploit code exists via a GitHub advisory. There is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or automated exploitation - this is POC availability, not confirmed in-the-wild use, and the two must not be conflated. A notable conflict: the endpoint /actions.json?action=assign-owner strongly implies an administrative/backend content-ownership action that would normally require an authenticated admin session, yet VulDB rates it PR:N (unauthenticated); this PR:N should be verified, as an authenticated-only path would lower real risk materially. The vendor (Intelliants) was contacted but did not respond and no patch exists, which raises residual risk for the shrinking population of live installs. Overall: a genuine but low-impact info-disclosure issue in a niche, largely-abandoned CMS - a lower priority than the CVSS number alone suggests.

A remote attacker sends a crafted request to /actions.json?action=assign-owner manipulating the q parameter to coax the application into returning data it should not disclose (e.g., user/owner records surfaced by the autocomplete-style lookup). Public exploit code is available via the volksec GitHub advisory, lowering the skill barrier. Because CVSS marks PR:N/UI:N, no user interaction is needed, though the admin-oriented endpoint name suggests authentication may in practice be required.