CVE-2026-84062

Deferred Deferred - Pending Action

Authorization Bypass in BurgerEditor via User-Controlled Key

Publication date: 2026-09-10

Last updated on: 2026-10-01

Assigner: JPCERT/CC

Description

BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may be altered by an attacker who can log in to the product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-10-01

Generated

2026-10-19

AI Q&A

2026-09-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-84062

EUVD

EUVD-2026-75231

Affected Vendors & Products

Vendor	Product	Version / Range
d-zero	burgereditor	From 3.0.0 (inc) to 3.4.0 (inc)
d-zero	burgereditor	From 2.28.0 (inc) to 2.30.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-84062 is an authorization bypass vulnerability in the BurgerEditor plugin for baserCMS. It allows authenticated attackers to bypass permission checks and upload arbitrary files, including malicious PHP files. This can lead to arbitrary code execution and page content alteration.

Detection Guidance

Check if BurgerEditor versions 3.0.0 through 3.4.0 are installed. Inspect file uploads for unexpected PHP or executable files. Review server logs for unauthorized file uploads or modifications to page content.

Impact Analysis

An attacker with login access could exploit this to upload malicious files, alter website content, or execute arbitrary PHP code. This could result in unauthorized changes to the site, data breaches, or further compromise of the server hosting the application.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's security rules. Non-compliance may result in legal penalties, data loss, and reputational damage.

Mitigation Strategies

Update BurgerEditor to version 3.4.1 or later immediately. Disable file uploads if not required. Restrict executable file uploads via configuration settings. Deploy .htaccess files to block direct access to uploaded files.

Hi! I’m here to help you understand CVE-2026-84062. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70