CVE-2026-93504: SveltyCMS User Attribute Update Endpoint +server.ts access control

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-18 · updated 2026-09-23
Weakness: CWE-266

Description

A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The name of the patch is 05b4f9efeb79e9d72a693232334d7529687f896f. It is advisable to implement a patch to correct this issue.

Affected products

SveltyCMS: 0.0.6

References

https://github.com/SveltyCMS/SveltyCMS/
https://github.com/SveltyCMS/SveltyCMS/commit/05b4f9efeb79e9d72a693232334d7529687f896f
https://vuldb.com/cve/CVE-2026-93504
https://vuldb.com/submit/942849
https://vuldb.com/vuln/407421
https://vuldb.com/vuln/407421/cti
https://vuldb.com/submit/942849

Get alerted when CVE-2026-93504 or the next vulnerability affects your stack