CVE-2026-30452

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-30452

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30452.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-30452

Published

2026-04-21T00:00:00Z

Modified

2026-07-08T08:00:02.622690224Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to modify articles owned by users with higher privileges. By manipulating the article ID parameter during the duplicate-and-save workflow in textpattern/include/txp_article.php, an attacker can bypass authorization checks and overwrite content belonging to other users.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30452.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/textpattern/textpattern

Affected ranges

Type

GIT

Repo

https://github.com/textpattern/textpattern

Events

Introduced

61f5e46ffa39394b0af15be3fcf2102be06816a9

Last affected

61f5e46ffa39394b0af15be3fcf2102be06816a9

Database specific

{
    "cpe": "cpe:2.3:a:textpattern:textpattern:4.9.0:-:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "4.9.0-NA"
        },
        {
            "last_affected": "4.9.0-NA"
        }
    ]
}

Affected versions

4.*

4.9.0

4.9.0-NA

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30452.json"