Privilege Management Flaw in ken678 YznCMS Auth Group Handler
CVE-2026-120185

5.1MEDIUM

Key Information:

Vendor

Ken678

Status
Yzncms
Vendor
CVE Published:
31 October 2026

What is CVE-2026-120185?

A security vulnerability has been identified in the ken678 YznCMS, affecting versions up to 2.2.0. The flaw resides in the Backend function of the Auth Group Handler component found in app/admin/controller/auth/Group.php. This vulnerability allows an attacker to exploit improper privilege management, potentially gaining unauthorized access. Attackers can initiate this manipulation remotely, highlighting the need for timely upgrades. Users are advised to upgrade to version 2.2.1, which addresses this issue through the implementation of patch ed16cd7f7f73e0316ffa8a148d.

Affected Version(s)

YznCMS 2.0

YznCMS 2.1

YznCMS 2.2.0

References

https://vuldb.com/vuln/429502
vdb-entrytechnical-description
https://vuldb.com/vuln/429502/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-120185
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

danieluec (VulDB User)
.