Live › vulnerability › CVE-2026-120185
YznCMS, a PHP content management system, has a flaw in its admin auth group handler (app/admin/controller/auth/Group.php) that mishandles privileges. A remote attacker can use it to gain access beyond what their role allows, according to the NVD entry.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 23:46 UTC. All times on this page are UTC.
Sites running YznCMS up to version 2.2.0 with its admin auth group controller reachable. The sources do not say whether the attack needs an account, so teams should assume the admin area is in scope. Teams not running YznCMS can skip it.
No product ranges from the sources yet.
2.2.0app/admin/controller/auth/Group.php in the deployed code to confirm it is present2.2.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated remotely. Upgrading to version 2.2.1 is sufficient to fix this issue. The patch is named ed16cd7f7f73e0316ffa8a148d. You should upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-120185")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.