CVE-2022-1553: Leaking password protected articles content due to improper access control in publify/publify

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-05-16 · updated 2026-06-17
Weakness: CWE-284

Description

Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, compromising confidentiality and integrity of users.

Affected products

publify/publify: before 9.2.8 — fixed in 9.2.8

How to fix

Upgrade to a fixed version: publify/publify 9.2.8. Check the vendor advisory for mitigations.

References

https://github.com/publify/publify/commit/1a78f16f460847274265a12a9555b3524892d7db
https://huntr.dev/bounties/b398e4c9-6cdf-4973-ad86-da796cde221f
https://github.com/publify/publify/commit/1a78f16f460847274265a12a9555b3524892d7db
https://huntr.dev/bounties/b398e4c9-6cdf-4973-ad86-da796cde221f

Get alerted when CVE-2022-1553 or the next vulnerability affects your stack