CVE-2026-88421

Deferred Deferred - Pending Action

Incorrect Access Control in APSL Puput Blog Entries Exposure

Publication date: 2026-09-25

Last updated on: 2026-09-30

Assigner: MITRE

Description

Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-30

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-88421

EUVD

EUVD-2026-87081

Affected Vendors & Products

Vendor	Product	Version / Range
apsl	puput	From 1.2.1 (inc) to 2.2.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an incorrect access control issue in the BlogPage.get_entries() component of APSL puput versions 1.2.1 through 2.2.0. It allows unauthenticated attackers to view blog entries that should be restricted by accessing the blog index, tag, category, author and date archives, sidebar widgets, or RSS feed.

Detection Guidance

To detect this vulnerability, check if restricted blog entries are exposed in public listings like the blog index, archives, or RSS feed. Verify if entries with password, login, or group restrictions appear in these sections. Examine the BlogPage.get_entries() method for missing .public() filters in the queryset.

Impact Analysis

An attacker could exploit this to access private or sensitive blog content without authentication. This may lead to unauthorized disclosure of information, privacy violations, or reputational damage if confidential content is exposed.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal or protected health information. Organizations may face legal penalties, fines, or reputational harm due to data breaches.

Mitigation Strategies

Upgrade APSL puput to a version beyond v2.2.0 where the access control issue has been fixed. If upgrading is not immediately possible, restrict network access to vulnerable components or disable affected features like archives, widgets, and RSS feeds until patched.

Hi! I’m here to help you understand CVE-2026-88421. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70