CVE-2026-44392

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44392", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2026-05-18T05:54:22.563Z", "datePublished": "2026-05-20T05:28:14.892Z", "dateUpdated": "2026-05-20T13:04:04.783Z"}, "containers": {"cna": {"affected": [{"vendor": "Six Apart Ltd.", "product": "Movable Type", "versions": [{"version": "9.1.1 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type", "versions": [{"version": "9.0.7 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type", "versions": [{"version": "8.8.3 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type", "versions": [{"version": "8.0.10 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced", "versions": [{"version": "9.1.1 and earlie", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced", "versions": [{"version": "9.0.7 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced", "versions": [{"version": "8.8.3 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced", "versions": [{"version": "8.0.10 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium", "versions": [{"version": "9.1.1 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium", "versions": [{"version": "9.0.7 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium", "versions": [{"version": "2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition)", "versions": [{"version": "9.1.1 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition)", "versions": [{"version": "9.0.7 and earlier", "status": "affected"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition)", "versions": [{"version": "2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed."}], "problemTypes": [{"descriptions": [{"description": "Missing authorization", "lang": "en-US", "cweId": "CWE-862", "type": "CWE"}]}], "references": [{"url": "https://movabletype.org/news/2026/05/mt-908-released.html"}, {"url": "https://www.sixapart.jp/movabletype/news/2026/05/20-1100.html"}, {"url": "https://jvn.jp/en/jp/JVN66473735/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-05-20T05:28:14.892Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-20T13:03:54.098462Z", "id": "CVE-2026-44392", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-20T13:04:04.783Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44392", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-20T13:03:54.098462Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-20T13:03:58.713Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Six Apart Ltd.", "product": "Movable Type", "versions": [{"status": "affected", "version": "9.1.1 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type", "versions": [{"status": "affected", "version": "9.0.7 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type", "versions": [{"status": "affected", "version": "8.8.3 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type", "versions": [{"status": "affected", "version": "8.0.10 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced", "versions": [{"status": "affected", "version": "9.1.1 and earlie"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced", "versions": [{"status": "affected", "version": "9.0.7 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced", "versions": [{"status": "affected", "version": "8.8.3 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Advanced", "versions": [{"status": "affected", "version": "8.0.10 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium", "versions": [{"status": "affected", "version": "9.1.1 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium", "versions": [{"status": "affected", "version": "9.0.7 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium", "versions": [{"status": "affected", "version": "2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition)", "versions": [{"status": "affected", "version": "9.1.1 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition)", "versions": [{"status": "affected", "version": "9.0.7 and earlier"}]}, {"vendor": "Six Apart Ltd.", "product": "Movable Type Premium (Advanced Edition)", "versions": [{"status": "affected", "version": "2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)"}]}], "references": [{"url": "https://movabletype.org/news/2026/05/mt-908-released.html"}, {"url": "https://www.sixapart.jp/movabletype/news/2026/05/20-1100.html"}, {"url": "https://jvn.jp/en/jp/JVN66473735/"}], "descriptions": [{"lang": "en", "value": "Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-862", "description": "Missing authorization"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-05-20T05:28:14.892Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44392", "state": "PUBLISHED", "dateUpdated": "2026-05-20T13:04:04.783Z", "dateReserved": "2026-05-18T05:54:22.563Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2026-05-20T05:28:14.892Z", "assignerShortName": "jpcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Movable Type", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "9.1.1 and earlier"}]}, {"product": "Movable Type", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "9.0.7 and earlier"}]}, {"product": "Movable Type", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "8.8.3 and earlier"}]}, {"product": "Movable Type", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "8.0.10 and earlier"}]}, {"product": "Movable Type Advanced", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "9.1.1 and earlie"}]}, {"product": "Movable Type Advanced", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "9.0.7 and earlier"}]}, {"product": "Movable Type Advanced", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "8.8.3 and earlier"}]}, {"product": "Movable Type Advanced", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "8.0.10 and earlier"}]}, {"product": "Movable Type Premium", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "9.1.1 and earlier"}]}, {"product": "Movable Type Premium", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "9.0.7 and earlier"}]}, {"product": "Movable Type Premium", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)"}]}, {"product": "Movable Type Premium (Advanced Edition)", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "9.1.1 and earlier"}]}, {"product": "Movable Type Premium (Advanced Edition)", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "9.0.7 and earlier"}]}, {"product": "Movable Type Premium (Advanced Edition)", "vendor": "Six Apart Ltd.", "versions": [{"status": "affected", "version": "2.15 and earlier (included in Movable Type 8.8.4 and earlier or Movable Type 8.0.11 and earlier)"}]}], "source": "vultures@jpcert.or.jp"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed."}, {"lang": "es", "value": "Vulnerabilidad de falta de autorizaci\u00f3n existe en Movable Type. Bajo ciertas condiciones, cuando un usuario sin privilegios de administrador inicia sesi\u00f3n en el producto, se puede ejecutar un procesamiento de actualizaci\u00f3n no intencionado."}], "id": "CVE-2026-44392", "lastModified": "2026-07-24T10:10:00.197", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44392", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-20T13:03:54.098462Z", "version": "2.0.3"}}]}, "published": "2026-05-20T07:16:15.317", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN66473735/"}, {"source": "vultures@jpcert.or.jp", "url": "https://movabletype.org/news/2026/05/mt-908-released.html"}, {"source": "vultures@jpcert.or.jp", "url": "https://www.sixapart.jp/movabletype/news/2026/05/20-1100.html"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.1.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.0.7]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.8.3]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.0.10]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Movable Type", "source": "cna", "vendor": "Six Apart Ltd."}, "product": "movable_type", "vendor": "six_apart"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.1.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.0.7]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.8.3]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.0.10]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "movable_type_advanced", "vendor": "six_apart"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.15]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.1.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.0.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "movable_type_premium", "vendor": "six_apart"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.1.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.0.7]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.15]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": "Movable Type Premium (Advanced Edition)", "source": "cna", "vendor": "Six Apart Ltd."}, "product": "movable_type_premium_advanced_edition", "vendor": "six_apart"}], "created": "2026-05-20T07:30:25.323477+00:00", "title": "Missing Authorization Allows Unintended Updates in Movable Type", "updated": "2026-05-20T10:37:56.320031+00:00", "vendors": ["six_apart", "six_apart$PRODUCT$movable_type", "six_apart$PRODUCT$movable_type_advanced", "six_apart$PRODUCT$movable_type_premium", "six_apart$PRODUCT$movable_type_premium_advanced_edition"]}