Intelliants Subrion CMS Info Disclosure and Redirect

Information disclosure in Intelliants Subrion CMS up to 4.2.1 lets remote attackers retrieve owner/user information through a manipulated q parameter in the /actions.json?action=assign-owner endpoint. Publicly available exploit code exists, but there is no confirmed active exploitation such as a CISA KEV entry. The CVSS 4.0 score is 5.5, while the independent assessment rates real-world risk as LOW-to-MODERATE because impact is partial confidentiality only and the administrative nature of assign-owner may in practice require a valid authenticated session even though the published vector lists PR:N; authentication requirements should be verified against the deployed instance.

An open redirect in the Subrion CMS login flow (front/login.php, iaUsers::authorize) through unvalidated use of the $_SERVER['HTTP_REFERER'] value lets remote, unauthenticated attackers send a crafted link that, once the victim follows it and interacts with the login page, redirects the browser to an attacker-controlled destination. Affected deployments are Intelliants Subrion CMS releases up to and including 4.2.1; the vendor was contacted early but did not respond, and publicly available exploit code exists, so the technique is trivially reproducible. The impact is deliberately narrow - no data disclosure, code execution, or denial of service - and the flaw only amplifies phishing and social-engineering campaigns, which is consistent with the low vendor CVSS 4.0 base score of 2.1; there is no indication of confirmed active exploitation (no CISA KEV listing).