What’s Vulnerable › Vulnerabilities

CVE-2020-36890: Kentico Xperience <= 10 Administrator Access Control Bypass

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-18 · updated 2026-08-10
• Weakness: CWE-862

Description

An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalidate security-sensitive macros by manipulating user privilege levels.

Affected products

• Kentico Xperience: through 12.0.60

References

• https://devnet.kentico.com/download/hotfixes
• https://www.vulncheck.com/advisories/kentico-xperience-administrator-access-control-bypass

Get alerted when CVE-2020-36890 or the next vulnerability affects your stack