Feehi CMS EUVD-2026-92783

Requires a pre-existing authenticated backend administrator account that holds the administrator-update permission in Feehi CMS 2.1.1; exploitation targets the user-management update flow, which fails to protect the built-in super administrator account and does not require that account's current/old password. Limiting factors: the attacker must already have valid privileged backend access (PR:H - escalation from a lower admin to super admin, not unauthenticated access), the specific administrator-update permission must be granted, and the target must be running the vulnerable 2.1.1 release; no victim user interaction is needed.

The input CVSS of 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) frames this as a High-severity but privilege-gated flaw: AV:N and AC:L make exploitation trivial once access exists, but PR:H confirms the attacker must already hold a privileged backend administrator account (specifically one with the administrator-update permission), so this is a privilege-escalation / account-takeover issue rather than a remote-unauthenticated breach. No EPSS score, KEV listing, or SSVC decision data was provided, and the input contains no confirmed POC flag - one reference points to a tao0845/CVE-Request technical write-up that likely documents the issue, but functional weaponized exploit code is not confirmed from the data. Weighing the signals: the C:H/I:H/A:H impact is realistic because resetting the built-in super administrator password yields full CMS control, yet practical risk is bounded by (a) the requirement for an existing privileged account and (b) the product's obscurity. Net assessment - a credible insider/second-stage escalation vector worth patching, but not a mass-exploitation priority; treat as medium real-world risk despite the High CVSS. The missing EPSS and absence from KEV mean there is no evidence of active or widespread exploitation at time of analysis.

A low-privilege backend administrator (for example a content or sub-admin account) that has been granted the administrator-update permission opens the user-management update flow and submits a new password for the built-in super administrator account without supplying the current password. Because the server does not protect that account, the super admin credentials are overwritten and the attacker logs in as super admin, gaining full control of the CMS. A technical write-up is referenced in the CVE request, but no confirmed functional exploit is identified in the provided data.