Subrion CMS EUVD-2026-85760

Exploitation targets the Subrion CMS login page (front/login.php) and requires the victim to follow an attacker-crafted link so the vulnerable iaUsers::authorize function processes an attacker-influenced $_SERVER['HTTP_REFERER'] value (UI:P). No authentication is required (PR:N) and no special server configuration is needed beyond a reachable default Subrion CMS <=4.2.1 login endpoint. The primary limiting factors are the need for user interaction (a clicked link) and the inherently low impact - the flaw only redirects the browser and does not by itself disclose data or execute code; realistic risk is confined to phishing/social-engineering amplification.

This is a genuinely low-priority issue that the low CVSS score (vendor CVSS 4.0 base 2.1) correctly reflects. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) describes an unauthenticated, network-reachable open redirect whose only impact is a low integrity effect requiring victim interaction (UI:P) - no confidentiality or availability impact. Publicly available exploit code exists (VulDB / GitHub advisory), but there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation provided in the input, so the signals converge on 'real but minor.' Open redirects are phishing/social-engineering aids rather than direct compromise vectors: the E:P (proof-of-concept) exploit maturity plus the low technical impact means this is not a patching emergency. A conflicting factor worth noting: the affected product, Subrion CMS, appears to be an abandoned/discontinued project (latest affected version 4.2.1, and the vendor 'did not respond in any way' to disclosure), so no fix is expected - mitigation must be compensating (WAF/referer validation) rather than a vendor patch.

An attacker crafts a malicious link that hits the Subrion CMS login page (front/login.php) with an attacker-controlled HTTP Referer header, so that after the login flow the iaUsers::authorize function redirects the victim's browser to an external attacker-controlled site. This is used to lend legitimacy to a phishing page (the victim sees a trusted Subrion domain in the original link). A public proof-of-concept exists on GitHub, and the attack requires the victim to click the link (UI:P).