Remote Code Execution Vulnerability in Gouguoa Affected by Improper Privilege Management
CVE-2026-84430

5.3MEDIUM

Key Information:

Vendor: Gouguoa
Status: Gouguoa
Vendor: CVE Published:; 2 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-84430?

A security vulnerability exists in Gouguoa versions up to 5.10.0 and 6.0.1, specifically within the update function in app/home/controller/Index.php of the edit_personal endpoint. This flaw allows an attacker to manipulate the position_id argument, leading to the potential for dynamically-determined object attributes. The vulnerability can be exploited remotely, posing a risk to system integrity. It is crucial for users to upgrade to version 6.0.3 to remediate this issue, as public disclosures indicate that this exploit may soon be leveraged by malicious actors.

Affected Version(s)

gouguoa 5.0

gouguoa 5.1

gouguoa 5.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-84430 - Proof of Concept