| Title | FluentCMS 0.0.5 improper authorization |
|---|
| Description | An improper authorization vulnerability was identified in FluentCMS up to 0.0.5 and in dev commit c63d49cdbc1f4051d34bb71087d904c56e33951e. An authenticated administrator restricted to one site can enumerate another site and access assets owned by that other site.
The first root cause is located in src/Backend/FluentCMS.Services/Permissions/PermissionManager.cs. The _userRoles, _roles, and _permissions collections are initialized with the null-coalescing assignment operator while HasAccess is called repeatedly for different siteId values by GetAccessible. Authorization data loaded for the first site is therefore reused for subsequent sites without being keyed by siteId.
A second object-level authorization failure exists in FolderService and FileService. Methods including FolderService.GetAll/GetById and FileService.Create/GetById access objects by UUID without verifying that the authenticated user has access to the owning SiteId.
Proof of concept: create Site A and Site B. Assign a test user to the Administrators role of Site A only. Authenticate as that user and open /admin/sites. Site B and its ID are returned despite the missing Site B role. Supply a Site B folder UUID to /admin/files?folderId=<SITE_B_FOLDER_UUID>. The page returns Site B filenames and download paths. Uploading a benign text file while that folder is selected creates an object whose siteId and folderId belong to Site B while createdBy contains the Site A-only administrator.
This violates tenant isolation and may allow unauthorized disclosure, upload, rename, move, or deletion of another site's assets. Multi-site installations are affected.
CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2). CWE-862 and CWE-639.
Vendor was informed on 2026-07-25 through GitHub issue 2409 because the repository has no SECURITY.md and private vulnerability reporting is disabled. No CVE was found for this issue and it has not been submitted to another CNA. |
|---|
| Source | ⚠️ https://github.com/fluentcms/FluentCMS/issues/2409 |
|---|
| User | volksec (UID 93050) |
|---|
| Submission | 07/25/2026 05:16 (1 month ago) |
|---|
| Moderation | 09/06/2026 14:51 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 399430 [FluentCMS up to 0.0.5 PermissionManager.cs GetAccessible authorization] |
|---|
| Points | 20 |
|---|