CVE-2026-73849
Received Received - Intake

Unauthenticated Database Reconfiguration in Emlog

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: GitHub, Inc.

Description
Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email values to cause file_put_contents('config.php', $config) to overwrite the configuration with attacker-controlled database settings and create a new administrator account. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-73849
EUVD
EUVD-2026-58742

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
emlog emlog to 2.6.19 (inc)
emlog emlog to 2.6.26 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in emlog versions 2.6.26 and earlier allows unauthenticated remote attackers to reinstall the system via install.php?action=reinstall. The flaw bypasses the installed-system check and overwrites config.php with attacker-controlled database settings, creating a new admin account.

Detection Guidance

Check for unauthorized access to install.php with action=reinstall. Inspect web server logs for POST requests to install.php containing action=reinstall. Verify if config.php has been recently modified without legitimate admin action.

Impact Analysis

An attacker can gain full control of your emlog website by overwriting configuration files and creating an admin account. This leads to complete compromise of confidentiality, integrity, and availability of your site and data.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection (GDPR, HIPAA) due to unauthorized access leading to potential data breaches, loss of data integrity, and failure to maintain adequate security controls.

Mitigation Strategies

Immediately restrict access to install.php by renaming or deleting it. Ensure config.php is not writable by the web server. Review database credentials and admin accounts for unauthorized changes. Monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73849. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart