CVE-2026-35183

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35183", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-01T17:26:21.133Z", "datePublished": "2026-04-06T19:11:28.807Z", "dateUpdated": "2026-04-07T16:14:01.519Z"}, "containers": {"cna": {"title": "Brave CMS has an Insecure Direct Object Reference in Article Image Deletion", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-cpf3-fxwg-cwr3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-cpf3-fxwg-cwr3"}], "affected": [{"vendor": "Ajax30", "product": "BraveCMS-2.0", "versions": [{"version": "< 2.0.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T19:11:28.807Z"}, "descriptions": [{"lang": "en", "value": "Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the article image deletion feature. It is located in app/Http/Controllers/Dashboard/ArticleController.php within the deleteImage method. The endpoint accepts a filename from the URL but does not verify ownership. This allows an authenticated user with edit permissions to delete images attached to articles owned by other users. This vulnerability is fixed in 2.0.6."}], "source": {"advisory": "GHSA-cpf3-fxwg-cwr3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T16:13:13.157525Z", "id": "CVE-2026-35183", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T16:14:01.519Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35183", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T16:13:13.157525Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T16:13:50.991Z"}}], "cna": {"title": "Brave CMS has an Insecure Direct Object Reference in Article Image Deletion", "source": {"advisory": "GHSA-cpf3-fxwg-cwr3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Ajax30", "product": "BraveCMS-2.0", "versions": [{"status": "affected", "version": "< 2.0.6"}]}], "references": [{"url": "https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-cpf3-fxwg-cwr3", "name": "https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-cpf3-fxwg-cwr3", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the article image deletion feature. It is located in app/Http/Controllers/Dashboard/ArticleController.php within the deleteImage method. The endpoint accepts a filename from the URL but does not verify ownership. This allows an authenticated user with edit permissions to delete images attached to articles owned by other users. This vulnerability is fixed in 2.0.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T19:11:28.807Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35183", "state": "PUBLISHED", "dateUpdated": "2026-04-07T16:14:01.519Z", "dateReserved": "2026-04-01T17:26:21.133Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-06T19:11:28.807Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "BraveCMS-2.0", "vendor": "Ajax30", "versions": [{"status": "affected", "version": "< 2.0.6"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ajax30:bravecms:*:*:*:*:*:*:*:*", "matchCriteriaId": "68058898-316C-481E-A190-0E50C51A015D", "versionEndExcluding": "2.0.6", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the article image deletion feature. It is located in app/Http/Controllers/Dashboard/ArticleController.php within the deleteImage method. The endpoint accepts a filename from the URL but does not verify ownership. This allows an authenticated user with edit permissions to delete images attached to articles owned by other users. This vulnerability is fixed in 2.0.6."}, {"lang": "es", "value": "Brave CMS es un CMS de c\u00f3digo abierto. Antes de la versi\u00f3n 2.0.6, existe una vulnerabilidad de Referencia Directa Insegura a Objeto (IDOR) en la funci\u00f3n de eliminaci\u00f3n de im\u00e1genes de art\u00edculos. Se encuentra en app/HTTP/Controllers/Dashboard/ArticleController.php dentro del m\u00e9todo deleteImage. El endpoint acepta un nombre de archivo de la URL pero no verifica la propiedad. Esto permite que un usuario autenticado con permisos de edici\u00f3n elimine im\u00e1genes adjuntas a art\u00edculos propiedad de otros usuarios. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 2.0.6."}], "id": "CVE-2026-35183", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35183", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T16:13:13.157525Z", "version": "2.0.3"}}]}, "published": "2026-04-06T20:16:26.727", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-cpf3-fxwg-cwr3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "BraveCMS-2.0", "source": "cna", "vendor": "Ajax30"}, "product": "bravecms-2.0", "vendor": "ajax30"}], "analysis": {"en": {"generated_at": "2026-04-14T18:58:18.226998+00:00", "value": {"mitigation_remediation": ["Apply the official update to Brave CMS 2.0.6 or later", "If immediate upgrade is not possible, disable image deletion for non\u2011administrative users while a patch is applied", "Verify that the deleteImage endpoint now checks ownership before allowing a delete operation", "Monitor system logs for unauthorized image deletion attempts and audit user permissions"], "summary": {"action": "Patch Immediately", "impact": "Unauthorized Deletion of Article Images"}, "threat_synthesis": {"affected_systems": "The affected product is Ajax30 BraveCMS 2.0, specifically any deployment running a version prior to 2.0.6; the vulnerability resides in app/Http/Controllers/Dashboard/ArticleController.php within the deleteImage method and is fixed in version 2.0.6 and later.", "description_and_impact": "Brave CMS versions earlier than 2.0.6 contain an Insecure Direct Object Reference in the article image deletion feature, in which the deleteImage method accepts a filename from the request URL but does not verify that the requester owns the image or its parent article; as a result, any authenticated user who has edit permissions can delete images that belong to other users\u2019 articles, leading to loss of asset integrity and possible content disruption.", "risk_and_exploitability": "The CVSS score of 7.1 indicates moderate severity, while the EPSS score of less than 1% shows a low probability of exploitation; the vulnerability is not listed in the CISA KEV catalog, and it requires an authenticated user with edit rights to exercise the IDOR, with no requirement for privilege escalation or remote code execution."}}}}, "created": "2026-04-07T06:54:28.742178+00:00", "updated": "2026-04-15T16:30:09.736867+00:00", "vendors": ["ajax30", "ajax30$PRODUCT$bravecms-2.0"]}