CVE-2026-120185

Received Received - Intake

Improper Privilege Management in YznCMS

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: VulDB

Description

A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated remotely. Upgrading to version 2.2.1 is sufficient to fix this issue. The patch is named ed16cd7f7f73e0316ffa8a148d. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-31

Last Modified

2026-10-31

Generated

2026-11-01

AI Q&A

2026-11-01

EPSS Evaluated

N/A

NVD

CVE-2026-120185

Affected Vendors & Products

Vendor	Product	Version / Range
ken678	YznCMS	2.0
ken678	YznCMS	2.1
ken678	YznCMS	2.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper privilege management flaw in ken678 YznCMS versions up to 2.2.0. It exists in the Backend function of the file app/admin/controller/auth/Group.php within the Auth Group Handler component. The issue allows remote attackers to manipulate privileges due to insufficient access controls.

Detection Guidance

To detect this vulnerability, check the version of ken678 YznCMS installed on your system. If it is version 2.2.0 or earlier, the system is vulnerable. Compare the installed version against the patched version 2.2.1.

Impact Analysis

An attacker could exploit this flaw to gain unauthorized privileges within the YznCMS system. This may allow them to perform actions beyond their intended permissions, such as modifying user roles, accessing sensitive data, or disrupting system operations. The remote attack vector increases the risk as it does not require local access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Improper privilege management may result in non-compliance with access control and data protection provisions, potentially leading to legal penalties or reputational damage.

Mitigation Strategies

Upgrade the ken678 YznCMS component to version 2.2.1 or later to address the improper privilege management flaw in the Auth Group Handler.

Hi! I’m here to help you understand CVE-2026-120185. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70