Improper Access Control in SveltyCMS Affects User Attribute Update Endpoint

CVE-2026-93504

What is CVE-2026-93504?

A vulnerability exists in SveltyCMS version 0.0.6 within the User Attribute Update Endpoint located at src/routes/api/[...path]/+server.ts. This flaw allows attackers to exploit insufficient access control measures, which may lead to unauthorized access or manipulation of user attributes. The vulnerability can be exploited remotely, making systems utilizing this version of SveltyCMS particularly susceptible. To mitigate this issue, a patch has been released, identified as commit 05b4f9efeb79e9d72a693232334d7529687f896f, which should be applied promptly to secure affected systems.

References