CVE-2026-116623
Received Received - Intake

Missing Authorization in Simple Content Management System Admin Interface

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulDB

Description
A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-116623
EUVD
EUVD-2026-110577

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
code-projects Simple Content Management System 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-116623 is a missing authorization vulnerability in code-projects Simple Content Management System 1.0. The file /web/admin/welcome.php lacks session validation, allowing unauthenticated users to access administrative functions like adding news by manipulating the addnews parameter. The attack is remote and requires no credentials.

Detection Guidance

Check if the administrative page /web/admin/welcome.php is accessible without authentication. Try accessing http://localhost:8000/web/admin/welcome.php or http://localhost:8000/web/admin/welcome.php?addnews directly in a browser or via curl commands to see if it allows unauthenticated access.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the admin panel, create or modify content without permission, and potentially deface the website or inject malicious content visible to all visitors. This bypasses the intended login system entirely.

Compliance Impact

This vulnerability could lead to unauthorized content changes, potentially violating integrity and access control requirements in GDPR and HIPAA. Unauthorized data modification or exposure may result in compliance violations and legal consequences.

Mitigation Strategies

Immediately enforce session checks at the start of every administrative page like welcome.php. Redirect unauthenticated users to the login page. Ensure the session_start() function is called and the $_SESSION['user'] value is verified before granting access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116623. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart