CVE-2026-108812
6.5MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-266, CWE-285
Impact
Remote unauthenticated attackers can delete arbitrary user accounts by sending requests directly to the administrative user interface. They only need network access to the web endpoint.
Root cause
Improper authorization checks in `/admin/SEMCMS_User.php` allow unauthenticated users to trigger the user deletion function via the `Class=Deleted&CF=user` query parameters.
Affected systems
SEMCMS through 5.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Fix & remediation
No official patched version is available since the vendor did not respond. Block external access to the `/admin/` path or restrict access to `/admin/SEMCMS_User.php` using web server access controls.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.