Authorization Bypass in Movable Type by Six Apart
CVE-2026-44392
5.3MEDIUM
What is CVE-2026-44392?
A missing authorization vulnerability has been identified in Movable Type, a web publishing platform by Six Apart. This flaw allows users without administrator privileges to execute unintended update processing when they sign in, potentially leading to unauthorized changes. It is essential for users and administrators to be aware of this vulnerability and take necessary measures to secure their installations to prevent exploitation.
Affected Version(s)
Movable Type 9.1.1 and earlier
Movable Type 9.0.7 and earlier
Movable Type 8.8.3 and earlier
References
CVSS V4
Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
CVSS V3.0
Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved