CVE-2026-16337
Received Received - Intake

Improper Authorization in dotCMS Leading to RCE

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: dotCMS LLC

Description
Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote code execution via a crafted OSGi bundle upload whose BundleActivator executes arbitrary shell commands.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-16337
EUVD
EUVD-2026-46076

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dotcms dotcms From 21.02 (inc) to 26.06.22-03 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a privilege escalation vulnerability in dotCMS versions 21.02 through 26.06.22-03. It allows any authenticated backend user to gain CMS Administrator privileges and execute arbitrary OS commands via OSGi bundle upload. The attack involves two flaws: self-assigning admin Settings layout without checks and granting the CMS Administrator role through a flawed endpoint.

Detection Guidance

Check for unauthorized role assignments or OSGi bundle uploads in dotCMS logs. Look for PUT requests to /api/v1/toolgroups/{id}/_addtouser or POST requests to /dwr/call/plaincall/RoleAjax.addUserToRole.dwr from non-admin users. Verify admin privileges were not self-assigned.

Impact Analysis

An attacker with low privileges could escalate to admin rights, modify system settings, access sensitive data, or execute malicious commands on the server. This could lead to full system compromise, data theft, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected dotCMS versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade to a patched dotCMS version beyond 26.06.22-03. Review user roles and remove any unauthorized admin assignments. Monitor for suspicious OSGi bundle uploads and restrict backend user access to privileged endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16337. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart