CVSS 7.2 (high) ยท published 2026-10-20
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
Weakness: CWE-862, CWE-915
Source: NVD CVE-2026-112239
Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.