CVE-2026-29597

DDSN Interactive cm3 Acora CMS version 10.7.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive configuration files by force browsing the “/Admin/file_manager/file_details.asp” endpoint and manipulating the “file” parameter. By referencing specific files (e.g., cm3.xml), the attacker can retrieve system administrator credentials, SMTP settings, database credentials, and other confidential information. The exposure of this information can lead to full administrative access to the CMS, unauthorized access to email services, compromise of backend databases, lateral movement within the network, and long-term persistence by an attacker. This access control bypass poses a critical risk of account takeover, privilege escalation, and systemic compromise of the affected application and its associated infrastructure.

• CWE-284

• https://github.com/padayali-JD/CVE-2026-29597

Published

Mar 30, 2026

Last Modified

Jul 5, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2954A vulnerability was found in Dromara UJCMS 10.0.2. Impacted …9.8
• CVE-2026-2955The AI Chatbot & Workflow Automation by AIWU plugin for Word…6.4
• CVE-2026-2956A security flaw has been discovered in qinming99 dst-admin u…8.8
• CVE-2026-2957A weakness has been identified in qinming99 dst-admin up to …8.1
• CVE-2026-2958A security vulnerability has been detected in D-Link DWR-M96…8.8
• CVE-2026-2959A vulnerability was detected in D-Link DWR-M960 1.01.07. Aff…8.8
• CVE-2026-29598Multiple stored cross-site scripting (XSS) vulnerabilities i…5.4
• CVE-2026-2960A flaw has been found in D-Link DWR-M960 1.01.07. Affected b…8.8
• CVE-2026-29606OpenClaw versions prior to 2026.2.14 contain a webhook signa…6.5
• CVE-2026-29607OpenClaw versions prior to 2026.2.22 contain an authorizatio…7.1
• CVE-2026-29608OpenClaw 2026.3.1 contains an approval integrity vulnerabili…6.7
• CVE-2026-29609OpenClaw versions prior to 2026.2.14 contain a denial of ser…8.7