CVE-2026-108812: SEMCMS Authentication Bypass Vulnerability

CVE-2026-108812 Overview

CVE-2026-108812 is an improper authorization vulnerability [CWE-266] affecting SEMCMS versions up to 5.0. The flaw resides in an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. Attackers can manipulate the endpoint remotely to perform unauthorized actions, specifically the deletion of arbitrary user accounts without appropriate authorization checks. The exploit has been publicly disclosed and may be used by threat actors. The vendor was contacted early about this disclosure but did not respond, meaning no official patch coordination occurred prior to publication.

Critical Impact
Remote, unauthenticated attackers can abuse the user deletion endpoint to remove arbitrary user accounts, impacting the integrity and availability of the SEMCMS application.

Affected Products

SEMCMS (SEMCMS PHP)
SEMCMS versions up to and including 5.0
Component: /admin/SEMCMS_User.php with parameters Class=Deleted&CF=user

Discovery Timeline

2026-10-12 - CVE-2026-108812 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-108812

Vulnerability Analysis

The vulnerability stems from missing authorization controls on an administrative endpoint in SEMCMS. The script SEMCMS_User.php handles user management operations, including deletions, when invoked with Class=Deleted&CF=user. The endpoint fails to verify whether the request originates from an authenticated administrator with the required privileges. As a result, remote attackers can trigger deletion operations against arbitrary user records.

The weakness is categorized under [CWE-266: Incorrect Privilege Assignment]. The attack vector is network-based, requires no privileges, and no user interaction. Successful exploitation damages data integrity and availability by removing user accounts, which can disrupt business operations and lock legitimate users out of the platform.

Root Cause

The root cause is the absence of a server-side authorization check on the user deletion handler within SEMCMS_User.php. The application trusts request parameters without validating the caller's session or role. Any client capable of reaching the administrative URL path can invoke the deletion logic. This is a classic broken access control pattern where sensitive functions are reachable without enforcing the privilege boundary defined by the application.

Attack Vector

An attacker crafts an HTTP request to /admin/SEMCMS_User.php?Class=Deleted&CF=user targeting a vulnerable SEMCMS instance. Because the vulnerable code path does not require authentication tokens, administrator session cookies, or anti-forgery protections, the request can be issued directly or embedded in a social-engineering payload. Repeated requests can enumerate and delete user records, resulting in persistent damage to the application's user base.

No verified proof-of-concept code is published alongside this advisory. For technical details, refer to the public write-up at the GitHub Unauthorized Deletion Issue and the VulDB CVE-2026-108812 Entry.

Detection Methods for CVE-2026-108812

Indicators of Compromise

Unexpected HTTP GET or POST requests to /admin/SEMCMS_User.php containing the parameters Class=Deleted and CF=user.
Missing or empty Cookie or session headers on administrative requests that successfully modified data.
Sudden disappearance of user records from the SEMCMS database without a corresponding administrator audit entry.
Spikes in 200 OK responses to /admin/SEMCMS_User.php from untrusted source IP addresses.

Detection Strategies

Review web server access logs for requests to SEMCMS_User.php with the Class=Deleted parameter and correlate them with authenticated administrator sessions.
Alert on administrative endpoint access from source IPs outside the expected administrator network range.
Compare database user tables to backups to identify unauthorized deletions.
Deploy a web application firewall (WAF) rule to flag unauthenticated access to /admin/ paths.

Monitoring Recommendations

Enable verbose logging on all administrative URL paths within SEMCMS.
Forward web server and application logs to a centralized logging platform for retention and correlation.
Baseline normal administrator activity patterns and alert on deviations such as off-hours user deletions.
Monitor database audit logs for DELETE statements against the users table.

How to Mitigate CVE-2026-108812

Immediate Actions Required

Restrict network access to /admin/ paths using IP allow-listing on the web server or upstream firewall.
Place SEMCMS administrative endpoints behind a VPN or authenticated reverse proxy until a patch is available.
Disable the user deletion function in SEMCMS_User.php if operational workflows allow, pending vendor remediation.
Back up user tables and audit logs so that unauthorized deletions can be reconstructed.

Patch Information

At the time of publication, the SEMCMS vendor has not responded to disclosure and no official patch is available. Organizations running SEMCMS 5.0 or earlier should monitor the VulDB Vulnerability #416589 entry and the vendor's distribution channels for future updates. Until a patch is released, compensating controls described in this section should be enforced.

Workarounds

Add server-side authorization checks in SEMCMS_User.php that verify an authenticated administrator session before executing deletion logic.
Enforce WAF rules that block requests to /admin/SEMCMS_User.php?Class=Deleted&CF=user lacking valid session cookies or anti-CSRF tokens.
Require HTTP Basic Authentication at the web server layer for the entire /admin/ directory as an additional barrier.
Rotate administrator credentials and review all user accounts for integrity after applying mitigations.

bash

# Example nginx configuration restricting SEMCMS admin access to a trusted network
location ^~ /admin/ {
    allow 10.0.0.0/24;      # trusted admin network
    deny  all;
    auth_basic           "SEMCMS Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
    try_files $uri $uri/ =404;
}