CVE-2026-96772 in Subrion CMS
Summary
by MITRE • 09/24/2026
A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified within Intelliants Subrion CMS versions up to 4.2.1 represents a critical information disclosure flaw located specifically within the endpoint /actions.json?action=assign-owner. This component is part of the content management system's backend logic, which handles administrative and user assignment operations via JSON API requests. The core technical deficiency lies in how the application processes the q argument supplied by the client during this specific action. Instead of properly sanitizing or validating input before processing, the software fails to restrict access to sensitive internal data structures when handling malformed or specifically crafted queries. This lack of proper input validation allows an attacker to manipulate the query parameter in a way that forces the server to return detailed error messages or raw database responses that were not intended for public consumption.
From a technical perspective, this flaw aligns with CWE-209, which describes the generation of an error message that includes sensitive information from its own environment. By exploiting the improper handling of the q parameter, remote attackers can trigger exceptions or debug outputs that reveal internal file paths, database schema details, server configuration specifics, and potentially valid user credentials or session tokens embedded in stack traces. This type of vulnerability is particularly dangerous because it serves as a reconnaissance tool for subsequent attacks. The availability of such detailed system information significantly lowers the barrier for further exploitation, allowing adversaries to map the application architecture and identify other potential entry points with greater precision.
The operational impact of this vulnerability extends beyond mere data leakage. Because the exploit has been released publicly, automated scanning tools and malicious actors can easily leverage it against any instance running an affected version of Subrion CMS without requiring specialized knowledge or custom tooling development. This widespread availability increases the risk profile substantially, as even low-skill threat actors can execute these attacks at scale. The ability to extract sensitive internal information remotely means that organizations relying on this platform for their web presence are exposed to potential data breaches and compliance violations, particularly if personal identifiable information is stored within the revealed database structures or configuration files.
In terms of industry classification frameworks, this vulnerability maps directly to MITRE ATT&CK technique T1504, specifically the sub-technique related to Web Session Manipulation or Information Gathering via API endpoints. It also correlates with CWE-209 as noted previously and potentially CWE-78 if the underlying cause involves improper neutralization of special elements in OS commands during query construction, though the primary manifestation here is information leakage rather than command injection. The failure to implement robust access controls on internal JSON actions further highlights a gap in secure coding practices regarding API security, often categorized under OWASP API Security Top 10 issues related to broken object level authorization or excessive data exposure.
Mitigation strategies for this vulnerability are straightforward but require immediate action due to the public availability of exploits. The primary and most effective remediation is to upgrade Intelliants Subrion CMS to a version newer than 4.2.1, where the vendor has presumably addressed the input validation logic within the assign-owner action handler. For organizations that cannot immediately patch their systems, implementing a Web Application Firewall with rulesets designed to detect anomalous JSON payloads or specific error-generating patterns can provide temporary protection by blocking malicious requests before they reach the application layer. Additionally, administrators should configure server settings to suppress detailed stack traces and internal errors in production environments, ensuring that generic error messages are returned instead of raw diagnostic data. Regular security audits and penetration testing focused on API endpoints are also recommended to identify similar flaws across other parts of the CMS infrastructure.