CVE-2026-95263

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not require the old password.

• CWE-284

• https://github.com/liufee/cms
• https://github.com/tao0845/CVE-Request/blob/main/CVE-2026-95263.md

Published

Oct 5, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-95210Improper certificate validation in gnutls v3.8.13 causes the…9.1
• CVE-2026-9522Improper access control in the PAM account discovery feature…5.4
• CVE-2026-9523A vulnerability was detected in Acrel Electrical EEMS Enterp…7.3
• CVE-2026-9524A flaw has been found in xianrendzw EasyReport up to 2.0.17.…6.3
• CVE-2026-9525A vulnerability has been found in itsourcecode Electronic Ju…7.3
• CVE-2026-9526A vulnerability was found in itsourcecode Electronic Judging…7.3
• CVE-2026-95264Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An aut…6.5
• CVE-2026-95265Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF…7.5
• CVE-2026-9527A vulnerability was determined in itsourcecode Electronic Ju…4.3
• CVE-2026-95270A flaw has been found in dgtlmoon changedetection.io up to 0…3.7
• CVE-2026-95271A vulnerability has been found in dgtlmoon changedetection.i…7.3
• CVE-2026-95272A vulnerability was found in dgtlmoon changedetection.io up …3.7