CVE-2026-96772
Received Received - Intake

Information Disclosure in Subrion CMS via actions.json

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulDB

Description
A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-96772
EUVD
EUVD-2026-85759

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
intelliants subrion_cms to 4.2.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated active-member enumeration and email disclosure flaw in Subrion CMS versions 4.2.1 and earlier. It allows attackers to remotely query the /actions.json?action=assign-owner endpoint with a wildcard parameter to retrieve active user accounts, including their numeric IDs, full names, and email addresses. The issue occurs because the system lacks proper authentication and authorization checks, and SQL LIKE wildcards are not escaped.

Detection Guidance

To detect this vulnerability, check if your Subrion CMS version is 4.2.1 or earlier. Test the endpoint /actions.json?action=assign-owner&q= with a wildcard parameter like q=%. If the response includes member IDs, names, or emails without authentication, the system is vulnerable.

Impact Analysis

This vulnerability can enable targeted phishing attacks, credential stuffing, username discovery, and social engineering by exposing user emails and account details. Attackers can use this information to craft convincing attacks against users or to identify valid accounts for further exploitation.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized disclosure of personal data. GDPR requires protection of personal data, and HIPAA mandates safeguarding protected health information. The flaw allows attackers to retrieve user emails and names without consent, violating data protection principles.

Mitigation Strategies

Immediately upgrade Subrion CMS to a patched version. If no patch is available, restrict access to the /actions.json endpoint, require authentication for owner-assignment actions, remove email addresses from public responses, and implement rate limiting for member searches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96772. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart