CVE-2026-120185

MediumCVSS 4.7/10Last modified Nov 2, 2026

Description

A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated remotely. Upgrading to version 2.2.1 is sufficient to fix this issue. The patch is named ed16cd7f7f73e0316ffa8a148d. You should upgrade the affected component.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-266 CWE-269

Affected software

Vendor	Product	Versions
ken678	YznCMS	2.0; 2.1; 2.2.0

References

Timeline

Published: Oct 31, 2026
Last modified: Nov 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-12018910.0A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftp CVE-2026-120198.3Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115 allowed a remote attacker who had compromised CVE-2026-1201903.5A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functionality of the file u CVE-2026-1201917.3A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of the component API. Th CVE-2026-1201925.3A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the compone CVE-2026-1201947.5A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expressi CVE-2026-12019510.0A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of CVE-2026-1201969.9A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipul CVE-2026-1201979.9A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipula CVE-2026-12019810.0A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. S CVE-2026-1201994.3LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other u CVE-2026-12029.8A security flaw has been discovered in CRMEB up to 5.6.3. The affected element is the function appleLogin of the file crmeb/app/api/controll