CVE-2026-30452

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-21 · updated 2026-06-17
Weakness: CWE-284

Description

Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to modify articles owned by users with higher privileges. By manipulating the article ID parameter during the duplicate-and-save workflow in textpattern/include/txp_article.php, an attacker can bypass authorization checks and overwrite content belonging to other users.

Affected products

TextPattern CMS: 4.9.0

References

https://github.com/textpattern/textpattern
https://textpattern.com/weblog/textpattern-491-released-security-fixes-patches-and-tweaks

Get alerted when CVE-2026-30452 or the next vulnerability affects your stack