CVE-2026-4514: PbootCMS Backend UserController.php access control

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-21 · updated 2026-06-17
Weakness: CWE-266

Description

A flaw has been found in PbootCMS up to 3.2.12. Affected by this issue is some unknown functionality of the file apps/admin/controller/system/UserController.php of the component Backend. Executing a manipulation of the argument Field can lead to improper access controls. The attack may be performed from remote. The exploit has been published and may be used.

Affected products

PbootCMS: 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5 (+7)

References

https://github.com/zzj-create/cvetest/blob/main/VULN-06_BACKEND_ARBITRARY_FIELD_MODIFICATION_REPORT_EN.md#vuln-06-pbootcms-3212-backend-arbitrary-field-modification
https://vuldb.com/?ctiid.352079
https://vuldb.com/?id.352079
https://vuldb.com/?submit.773907

Get alerted when CVE-2026-4514 or the next vulnerability affects your stack