High
Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information
Type: advisorySources: OSV
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information. Versions 1.41.1 and 2.41.1 contain a patch.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-32300
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 08:19 UTC · Revision 1
Source evidence
Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information
core-osv · Original sourcePublished 23 Mar 2026, 21:40 UTC
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information. Versions 1.41.1 and 2.41.1 contain a patch.
osv:CVE-2026-32300
Complete source record
{
"id": "5e005c427b37dbfb214ba7511eaa2cdc83bb809a4799907935015645220c210e",
"url": "https://osv.dev/vulnerability/CVE-2026-32300",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information",
"summary": "Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information. Versions 1.41.1 and 2.41.1 contain a patch.",
"evidence": "osv:CVE-2026-32300",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-32300",
"aliases": [
"CVE-2026-32300",
"GHSA-qr6x-wvxr-8hm9"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/opensource-workshop/connect-cms",
"type": "GIT",
"events": [
{
"introduced": "e6b8bc451d6e9e233b1f87283ef8ee389d49888a"
},
{
"fixed": "04ffb2bfe4a4421f19bad8c9b8c75e2a6d931681"
},
{
"introduced": "ff435fbdf56c8c65ec419062b6fe4e09395b3095"
},
{
"fixed": "c2519d7983e850bb45dd60cea99db0fe97ed6edd"
},
{
"fixed": "7c9951738c62a1d51b91e9956d1eb756c5d52cce"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:opensource-workshop:connect-cms:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.41.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:opensource-workshop:connect-cms:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.41.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "7c9951738c62a1d51b91e9956d1eb756c5d52cce"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "04ffb2bfe4a4421f19bad8c9b8c75e2a6d931681"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.41.1"
},
{
"range": [
{
"fixed": "c2519d7983e850bb45dd60cea99db0fe97ed6edd"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.41.1"
}
]
}
}
],
"versions": [
"v2.41.0",
"v1.41.0",
"v2.40.0",
"v1.40.0",
"v2.39.0",
"v1.39.0",
"v2.38.1",
"v1.38.1",
"v2.38.0",
"v1.38.0",
"v2.37.0",
"v1.37.0",
"v2.36.0",
"v1.36.0",
"v2.35.0",
"v1.35.0",
"v2.34.0",
"v1.34.0",
"v1.33.1",
"v2.33.0",
"v1.33.0",
"v2.32.0",
"v1.32.0",
"v2.31.0",
"v1.31.0",
"2.30.0",
"v2.29.1",
"v1.30.0",
"v1.29.1",
"v2.29.0",
"v1.29.0",
"v2.28.0",
"v1.28.0",
"v2.27.0.1",
"v2.27.0",
"v1.27.0",
"v2.26.1",
"v1.26.1",
"v2.26.0",
"v1.26.0",
"v2.25.1",
"v1.25.1",
"v2.25.0",
"v1.25.0",
"v2.24.0",
"v1.24.0",
"v2.23.3",
"v1.23.3",
"v2.23.2",
"v1.23.2",
"v1.23.1",
"v2.23.0",
"v1.23.0",
"v2.22.0",
"v1.22.0",
"v2.21.0",
"v1.21.0",
"1.20.0",
"v2.19.2.1",
"v1.19.2",
"v2.19.0",
"v1.19.1",
"v1.19.0",
"v2.18.3",
"v1.18.3",
"v2.18.2",
"v1.18.2",
"v2.18.1",
"v1.18.1",
"v2.18.0",
"v1.18.0",
"v2.17.4",
"v1.17.4",
"v2.17.3",
"v1.17.3",
"v2.17.2",
"v1.17.2",
"v2.17.1",
"v1.17.1",
"v2.17.0",
"v1.17.0",
"v2.16.0",
"v1.16.0",
"v2.15.4",
"v1.15.4",
"v2.15.3",
"v1.15.3",
"v2.15.2",
"v1.15.2",
"v2.15.1",
"v1.15.1",
"v2.15.0",
"v1.15.0",
"v2.10.2",
"v1.14.2",
"v2.10.1",
"v1.14.1",
"v2.10.0",
"v1.14.0",
"v2.9.1",
"v1.13.1",
"v2.9.0",
"v1.13.0",
"v2.8.3",
"v1.12.3",
"v2.8.2",
"v2.8.1",
"v1.12.2",
"v2.7.5",
"v1.12.1",
"v1.11.5",
"v1.11.4",
"v2.7.4",
"v2.7.3",
"v1.11.3",
"v2.7.2",
"v1.11.2",
"v2.7.1",
"v1.11.1",
"v1.11.0",
"v2.7.0",
"v2.6.4",
"v1.10.4",
"v2.6.3",
"v1.10.3",
"v2.6.2",
"v1.10.2",
"v2.6.1",
"v1.10.1",
"v2.6.0",
"v1.9.4",
"v1.10.0",
"v2.5.11",
"v1.9.11",
"v2.5.10",
"v1.9.10",
"v2.5.9",
"v1.9.9",
"v2.5.8",
"v1.9.8",
"v2.5.7",
"v1.9.7",
"v2.5.6",
"v1.9.6",
"v2.5.5",
"v1.9.5",
"v2.5.4",
"v2.5.3",
"v1.9.3",
"v2.5.2",
"v1.9.2",
"v2.5.1",
"v1.9.1",
"v2.5.0",
"v1.9.0",
"v2.4.10",
"v1.8.10",
"v2.4.9",
"v1.8.9",
"v2.4.8",
"v1.8.8",
"v2.4.7",
"v1.8.7",
"v2.4.6",
"v1.8.6",
"v2.4.5",
"v1.8.5",
"v2.4.4",
"v1.8.4",
"v2.4.3",
"v1.8.3",
"v2.4.2",
"v1.8.2",
"v2.4.1",
"v1.8.1",
"v2.4.0",
"v1.8.0",
"v2.3.2",
"v1.7.2",
"v2.3.1",
"v1.7.1",
"v2.3.0",
"v1.7.0",
"v2.2.2",
"v1.6.2",
"v2.2.1",
"v1.6.1",
"v2.2.0",
"v1.6.0",
"v2.1.3",
"v1.5.2",
"v1.5.3",
"v2.1.2",
"v2.1.1",
"v1.5.1",
"v2.1.0",
"v1.5.0",
"v2.0.4",
"v1.2.7",
"v1.4.4",
"v2.0.3",
"v2.0.2",
"v1.4.3",
"v1.4.2",
"v2.0.0",
"v1.4.1",
"v1.4.0",
"v1.3.2",
"v1.3.1",
"v1.3.0",
"v1.2.8",
"v1.2.6",
"v1.2.5",
"v1.2.4",
"v1.2.3",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.1.3",
"v1.1.2",
"v1.1.1",
"v1.1.0",
"v1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32300.json"
}
}
],
"modified": "2026-10-28T02:30:27.320195651Z",
"provider": "osv",
"references": [
"https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1",
"https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32300.json",
"https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-qr6x-wvxr-8hm9",
"https://nvd.nist.gov/vuln/detail/CVE-2026-32300",
"https://github.com/opensource-workshop/connect-cms/commit/7c9951738c62a1d51b91e9956d1eb756c5d52cce"
],
"provider_metadata": {
"cwe_ids": [
"CWE-285",
"CWE-639"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32300.json"
}
},
"related_cves": [
{
"value": "CVE-2026-32300",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 493735,
"published_at": "2026-03-23T21:40:59.009+00:00"
}