{"id":"CVE-2026-120185","kind":"vulnerability","aliases":["CVE-2026-120185"],"related":[],"title":"YznCMS: auth group handler flaw enables improper privilege management","description":"A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated remotely. Upgrading to version 2.2.1 is sufficient to fix this issue. The patch is named ed16cd7f7f73e0316ffa8a148d. You should upgrade the affected component.","summary":"YznCMS, a PHP content management system, has a flaw in its admin auth group handler (app/admin/controller/auth/Group.php) that mishandles privileges. A remote attacker can use it to gain access beyond what their role allows, according to the NVD entry.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","php","self-hosted","yzncms"],"not_affected_if":["fixed-2.2.1","not-yzncms"],"how_to_check":"- Check the YznCMS version in the project, looking for any release up to `2.2.0`\n- Review `app/admin/controller/auth/Group.php` in the deployed code to confirm it is present","fix":"- YznCMS: upgrade to `2.2.1`","status":"open","published_at":"2026-10-31T23:17:11+00:00","first_seen_at":"2026-10-31T23:46:48+00:00","triaged_at":"2026-10-31T23:48:44+00:00","updated_at":"2026-10-31T23:48:44+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-31T23:48:44Z","model":"claude-haiku-5-5","output":{"fix":"- YznCMS: upgrade to `2.2.1`","reach":"internet","title":"YznCMS: auth group handler flaw enables improper privilege management","impact":"medium","summary":"YznCMS, a PHP content management system, has a flaw in its admin auth group handler (app/admin/controller/auth/Group.php) that mishandles privileges. A remote attacker can use it to gain access beyond what their role allows, according to the NVD entry.","audience":"businesses","category":"other","nicknames":[],"who_cares":["yzncms","php","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"remote user gains privileges they should not have","analyst_note":"Confirm whether the attack needs an authenticated account and what privileges are gained; check NVD and the upstream YznCMS commit for details.","how_to_check":"- Check the YznCMS version in the project, looking for any release up to `2.2.0`\n- Review `app/admin/controller/auth/Group.php` in the deployed code to confirm it is present","plain_action":"","needs_analyst":true,"not_affected_if":["not-yzncms","fixed-2.2.1"],"who_is_affected":"Sites running YznCMS up to version 2.2.0 with its admin auth group controller reachable. The sources do not say whether the attack needs an account, so teams should assume the admin area is in scope. Teams not running YznCMS can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000687,"input_tokens":4177,"output_tokens":538,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120185':12A,15A '-2026':11A,14A '2.2.0':71C '2.2.1':106C 'access':49B 'accord':55B 'admin':33B 'affect':73C,122C 'allow':54B 'app/admin/controller/auth/group.php':37B,82C 'attack':43B,98C 'auth':2A,34B,86C 'backend':78C 'beyond':50B 'compon':85C,123C 'content':25B 'cve':10A,13A 'discov':65C 'ed16cd7f7f73e0316ffa8a148d':117C 'element':74C 'enabl':6A 'entri':59B 'file':81C 'fix':110C 'flaw':5A,30B,62C 'function':77C 'gain':48B 'group':3A,35B,87C 'handler':4A,36B,88C 'host':20B 'improp':7A,94C 'initi':101C 'issu':112C 'ken678':67C 'manag':9A,26B,96C 'manipul':91C 'mishandl':39B 'name':116C 'nvd':58B 'patch':114C 'perform':89C 'php':17B,24B 'privileg':8A,40B,95C 'remot':42B,102C 'result':92C 'role':53B 'secur':61C 'self':19B 'self-host':18B 'suffici':108C 'system':27B 'upgrad':103C,120C 'use':45B 'version':105C 'yzncms':1A,21B,22B,68C","nicknames":[],"mitigations":[],"who_affected":"Sites running YznCMS up to version 2.2.0 with its admin auth group controller reachable. The sources do not say whether the attack needs an account, so teams should assume the admin area is in scope. Teams not running YznCMS can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T23:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120185","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120185","severity":null,"published_at":"2026-10-31T23:17:11+00:00","modified_at":"2026-10-31T23:17:11+00:00","first_seen_at":"2026-10-31T23:46:48+00:00","fetched_at":"2026-10-31T23:46:48+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}