CVE-2026-84062
Deferred Deferred - Pending Action

Authorization Bypass in BurgerEditor via User-Controlled Key

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: JPCERT/CC

Description
BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may be altered by an attacker who can log in to the product may be caused.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-30
AI Q&A
2026-09-10
EPSS Evaluated
2026-09-29
NVD
CVE-2026-84062
EUVD
EUVD-2026-75231

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
d-zero burgereditor From 3.0.0 (inc) to 3.4.0 (inc)
d-zero burgereditor From 2.28.0 (inc) to 2.30.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-84062 is an authorization bypass vulnerability in the BurgerEditor plugin for baserCMS. It allows authenticated attackers to bypass permission checks and upload arbitrary files, including malicious PHP files. This can lead to arbitrary code execution and page content alteration.

Detection Guidance

Check if BurgerEditor versions 3.0.0 through 3.4.0 are installed. Inspect file uploads for unexpected PHP or executable files. Review server logs for unauthorized file uploads or modifications to page content.

Impact Analysis

An attacker with login access could exploit this to upload malicious files, alter website content, or execute arbitrary PHP code. This could result in unauthorized changes to the site, data breaches, or further compromise of the server hosting the application.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's security rules. Non-compliance may result in legal penalties, data loss, and reputational damage.

Mitigation Strategies

Update BurgerEditor to version 3.4.1 or later immediately. Disable file uploads if not required. Restrict executable file uploads via configuration settings. Deploy .htaccess files to block direct access to uploaded files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84062. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart