CVE-2026-67207

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-67207

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67207.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-67207

Published

2026-07-30T19:30:45.125Z

Modified

2026-08-15T04:06:52.644323659Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController

Details

Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the incorrect evaluation of the access control expression to create, download, and restore backups without administrative privileges.

Database specific

{
    "cwe_ids": [
        "CWE-697"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67207.json",
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/wolfcms/wolfcms

Affected ranges

Type

GIT

Repo

https://github.com/wolfcms/wolfcms

Events

Introduced

Last affected

1b5a6c701b781a632e1364d6865946ee94a9002a

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.3.1"
        }
    ]
}

Affected versions

0.*

0.7.0

0.7.1

0.7.2

0.7.3

0.7.5

0.7.5-sp1

0.7.6

0.7.7

0.7.8

0.8.0

0.8.1

0.8.2

0.8.3

0.8.3.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67207.json"