Lin CMS vulnerable to Improper Authentication

published 2022-11-09 4 y ago modified 2026-07-07 4 mo ago also GHSA-4vrc-q7m6-vq7w , PYSEC-2026-839 , EUVD-2022-7230

cvss: 6.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits: 0; none known

An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator.

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 18 mo ago (2025-05-01)

Exploit prediction

1.22% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/cai-niao98/lin-cms/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	6.6	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	6.6	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	6.6	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	6.6	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
OSV	3.1	6.6	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	lin-cms	<=0.2.1	no fix listed
maven	io.github.talelin:lin-cms-core	<=0.2.1	no fix listed

Classification

Weakness

CWE-287 Improper Authentication

References

github.com /cai-niao98/lin-cms/
exploit, third-party-advisory
gist.github.com /cai-niao98/58c97899695488bd73a73d56adf44c4c
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2022-44244
advisory
github.com /TaleLin/lin-cms-flask
package
github.com /cai-niao98/lin-cms
web
pypi.org /project/lin-cms
package
github.com /advisories/GHSA-4vrc-q7m6-vq7w
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary