SveltyCMS User Attribute Update Endpoint +server.ts access control

published 2026-09-18 51 d ago modified 2026-09-23 46 d ago also EUVD-2026-82904

cvss: 6.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 30%
public exploits: 0; none known

A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The name of the patch is 05b4f9efeb79e9d72a693232334d7529687f896f. It is advisable to implement a patch to correct this issue.

Patch / fix

links 1

github.com/SveltyCMS/SveltyCMS@05b4f9e commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 46 d ago (2026-09-23)

Exploit prediction

0.37% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

vuldb.com https://vuldb.com/submit/942849 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
CNA	3.0	6.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
CNA	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

n/a SveltyCMS

Classification

Weakness

CWE-284 Improper Access Control
CWE-266 Incorrect Privilege Assignment

References

github.com /SveltyCMS/SveltyCMS/commit/05b4f9efeb79e9d72a693232334d7529687f896f
patch
vuldb.com /submit/942849
third-party-advisory, exploit
vuldb.com /vuln/407421
vdb-entry
vuldb.com /vuln/407421/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-93504
third-party-advisory
github.com /SveltyCMS/SveltyCMS/
product

Sources

CVE List CVE-2026-93504
NVD CVE-2026-93504

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary