CVE-2026-13544: Feehi CMS Auth Bypass Vulnerability

CVE-2026-13544 Overview

CVE-2026-13544 is an improper access control vulnerability in Feehi CMS up to version 2.1.1. The flaw resides in unknown functionality of the /api/users endpoint within the API component. Remote attackers with low privileges can exploit the weakness to bypass access controls and interact with user data outside their authorization scope. A public exploit has been released, increasing the practical risk to exposed instances. The project maintainers were notified through an issue report but have not responded at the time of publication.

Critical Impact
Authenticated remote attackers can abuse the /api/users endpoint to access user resources they should not be permitted to view or modify, undermining confidentiality and integrity within the CMS.

Affected Products

Feehi CMS versions up to and including 2.1.1
The /api/users API component
Deployments exposing the Feehi CMS API to untrusted networks

Discovery Timeline

2026-06-29 - CVE-2026-13544 published to the National Vulnerability Database (NVD)
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13544

Vulnerability Analysis

The vulnerability is classified under [CWE-266] Incorrect Privilege Assignment. Feehi CMS exposes the /api/users endpoint without enforcing sufficient authorization checks on the requesting principal. As a result, an authenticated user with low privileges can invoke functionality reserved for higher-privileged roles. The exposure enables limited disclosure and modification of user records reachable through the API. Because a public proof-of-concept has been released, opportunistic exploitation is feasible against internet-facing deployments.

Root Cause

The root cause is missing or inadequate authorization enforcement within the /api/users handler. The endpoint appears to validate authentication but does not consistently verify that the caller has permission to operate on the targeted user object or scope. This design gap allows privilege boundaries to be crossed through normal API calls.

Attack Vector

Exploitation is performed remotely over the network. An attacker authenticates to the Feehi CMS API using a low-privilege account and then issues crafted requests to /api/users. Because access controls are improperly applied, the request succeeds where it should be denied. No user interaction is required beyond attacker-controlled requests.

No verified proof-of-concept code has been reproduced here. Refer to the GitHub Issue #88, GitHub Issue #89, and the VulDB entry for CVE-2026-13544 for technical detail.

Detection Methods for CVE-2026-13544

Indicators of Compromise

Unexpected HTTP requests to /api/users from low-privilege session tokens returning 200 OK responses.
Bulk enumeration patterns against /api/users such as sequential ID access or repeated queries within a short window.
API responses containing user records that do not match the authenticated caller's role scope.

Detection Strategies

Review web server and application logs for authenticated requests to /api/users where the caller role should not permit access.
Correlate authentication events with subsequent API activity to identify privilege boundary violations.
Deploy runtime monitoring for the CMS host to flag anomalous outbound data volumes tied to the API process.

Monitoring Recommendations

Enable verbose access logging for the Feehi CMS API and forward logs to a centralized analytics platform.
Alert on repeated authorization failures followed by successful requests to the same endpoint by the same principal.
Track user account creation, modification, and enumeration events on the CMS backend for review.

How to Mitigate CVE-2026-13544

Immediate Actions Required

Restrict network exposure of the Feehi CMS /api/users endpoint to trusted administrative networks using a reverse proxy or WAF rule.
Rotate credentials for any low-privilege accounts that may have been used to test or exploit the endpoint.
Audit existing user records for unauthorized changes or additions since the CMS was deployed.

Patch Information

No vendor patch is available at the time of publication. The project was informed through an issue report but has not responded. Track the GitHub Issue #88 and GitHub Issue #89 for remediation updates.

Workarounds

Place the CMS behind an authenticated reverse proxy and block direct access to /api/users from untrusted sources.
Apply web application firewall rules that deny non-administrative session tokens from reaching /api/users.
Disable API access entirely if it is not required for production operation of the CMS.

bash

# Example NGINX rule to restrict /api/users to an allowlisted admin subnet
location /api/users {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://feehi_cms_upstream;
}