| शीर्षक | liufee cms 2.1.1 Any Article Delete |
|---|
| विवरण | A vulnerability was found in Feehi CMS 2.1.1. It has been classified as critical. Affected are multiple REST API endpoints (GET, POST, PUT, DELETE) of the /api/articles and /api/articles/{id} routes handled by api/controllers/ArticleController.php. The vulnerability is caused by a missing authentication mechanism ArticleController does not override the behaviors() method, resulting in no authenticator or access control filter being applied to any CRUD action. An unauthenticated remote attacker can retrieve all articles including unpublished drafts which may contain sensitive internal content, create new articles, modify existing ones, and permanently delete any article by simply sending the corresponding HTTP request without any token or credentials. This vulnerability requires zero authentication and exposes full read and write access to all article resources. |
|---|
| स्रोत | ⚠️ https://github.com/liufee/cms/issues/87 |
|---|
| उपयोगकर्ता | byname (UID 98259) |
|---|
| सबमिशन | 29/05/2026 10:16 AM (4 महीनों पहले) |
|---|
| संयम | 28/06/2026 12:58 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 374554 [Feehi CMS तक 2.1.1 REST API Endpoint /api/articles कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|