CVE-2021-26598

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-28 · updated 2026-06-17
Weakness: CWE-287

Description

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).

Affected products

ImpressCMS: before 1.4.3 — fixed in 1.4.3

How to fix

Upgrade to a fixed version: ImpressCMS 1.4.3. Check the vendor advisory for mitigations.

References

http://karmainsecurity.com/KIS-2022-03
http://seclists.org/fulldisclosure/2022/Mar/45
https://hackerone.com/reports/1081137
https://packetstormsecurity.com/files/166403/ImpressCMS-1.4.2-Incorrect-Access-Control.html
http://karmainsecurity.com/KIS-2022-03
http://seclists.org/fulldisclosure/2022/Mar/45
https://hackerone.com/reports/1081137
https://packetstormsecurity.com/files/166403/ImpressCMS-1.4.2-Incorrect-Access-Control.html

Get alerted when CVE-2021-26598 or the next vulnerability affects your stack