Privilege Escalation Vulnerability in CouchCMS by CouchCMS
CVE-2026-29002

8.6HIGH

Key Information:

Vendor

Couchcms

Status
Couchcms
Vendor
CVE Published:
10 April 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-29002?

CouchCMS suffers from a privilege escalation flaw that permits authenticated Admin-level users to create SuperAdmin accounts. This vulnerability arises from improper validation of the f_k_levels_list parameter during user creation requests. By manipulating the parameter value from 4 to 10 in the HTTP request, attackers can circumvent the authorization checks, granting them full control over the application, and bypassing the restrictions on SuperAdmin privilege assignments.

Affected Version(s)

CouchCMS 0 <= 2.4.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-29002 - Proof of Concept

References

https://gist.github.com/thepiyushkumarshukla/477e2d2bbbe8...
technical-descriptionexploit
https://www.couchcms.com/
product
https://www.vulncheck.com/advisories/couchcms-privilege-e...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Piyush Kumar Shukla
.