CVE-2026-96773 in Subrion CMS
Summary
by MITRE • 09/24/2026
A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $_SERVER['HTTP_REFERER'] causes open redirect. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The identified vulnerability resides within Intelliants Subrion CMS, specifically affecting versions up to 4.2.1, and targets the authentication mechanism implemented in the front/login.php file through the iaUsers::authorize function. This flaw is classified as an open redirect vulnerability resulting from improper validation of user-supplied input directed at the HTTP Referer header field. The core technical issue stems from the application's failure to adequately sanitize or validate the value contained within the $_SERVER['HTTP_REFERER'] superglobal variable before utilizing it for redirection purposes after a login attempt. By manipulating this specific argument, an attacker can craft requests that cause the web server to redirect users to arbitrary external domains rather than the intended internal pages following authentication events.
This type of vulnerability is formally categorized under CWE-601, which defines URL Redirection to Untrusted Site or Domain as a weakness where a software product redirects a user to a URI provided by an upstream component without sufficient validation that it resolves to a trusted destination. The operational impact of this flaw extends beyond simple misdirection; it serves as a potent vector for social engineering attacks. Attackers can exploit the open redirect to create deceptive links that appear legitimate because they originate from the trusted domain hosting Subrion CMS, yet ultimately lead victims to malicious phishing sites designed to harvest credentials or distribute malware. The presence of publicly available exploits significantly lowers the barrier to entry for threat actors, enabling widespread automated campaigns targeting installations running vulnerable versions without requiring complex custom development efforts.
From a tactical perspective aligned with the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Initial Access and Credential Harvesting. Specifically, it aligns with T1566.002, which covers Spearphishing Link attacks where attackers send links to malicious sites that mimic trusted entities to steal login credentials or install malware. The remote nature of the attack allows adversaries to deliver these payloads via email, instant messaging, or other communication channels without any prior authentication requirements on the target system itself. Although the vulnerability is triggered in the context of a login page interaction, the initial lure can be delivered entirely remotely through social engineering tactics that trick users into clicking malicious links leading to the compromised Subrion instance.
The vendor's lack of response to early disclosure attempts highlights critical gaps in security maintenance practices for this software ecosystem. Without an official patch or update from Intelliants, system administrators and developers must rely on alternative mitigation strategies to protect their deployments. Immediate remediation should involve implementing server-side input validation that strictly whitelists allowed redirect destinations rather than trusting the Referer header directly. Additionally, deploying a Web Application Firewall with rules capable of detecting anomalous redirection patterns can provide an additional layer of defense against exploitation attempts while organizations plan for migration or upgrade paths to more secure content management platforms.