CVE-2026-30452 — MEDIUM (6.5)

Vulnerability Description

Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to modify articles owned by users with higher privileges. By manipulating the article ID parameter during the duplicate-and-save workflow in textpattern/include/txp_article.php, an attacker can bypass authorization checks and overwrite content belonging to other users.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Textpattern	Textpattern	4.9.0

Related Weaknesses (CWE)

CWE-284

References

FAQ

What is CVE-2026-30452?

CVE-2026-30452 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to modify articles owned by users with higher ...

How severe is CVE-2026-30452?

CVE-2026-30452 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-30452?

Check the references section above for vendor advisories and patch information. Affected products include: Textpattern Textpattern.