CVE-2026-13546: Feehi CMS Authentication Bypass Vulnerability

CVE-2026-13546 Overview

CVE-2026-13546 is a missing authentication vulnerability [CWE-287] affecting Feehi CMS versions up to 2.1.1. The flaw resides in the /api/articles REST API endpoint. Unauthenticated remote attackers can interact with the endpoint without providing credentials, resulting in unauthorized access to article data and management functions. Public exploit details are available, increasing the likelihood of opportunistic attacks against exposed installations. The project maintainers were notified through a GitHub issue but have not responded at the time of publication, meaning no official patch is currently available.

Critical Impact
Remote unauthenticated attackers can access the /api/articles REST endpoint of Feehi CMS, compromising the confidentiality, integrity, and availability of article content managed by the CMS.

Affected Products

Feehi CMS versions up to and including 2.1.1
REST API Endpoint /api/articles
Project repository: liufee/cms on GitHub

Discovery Timeline

2026-06-29 - CVE-2026-13546 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13546

Vulnerability Analysis

The vulnerability affects the REST API layer of Feehi CMS, specifically the /api/articles endpoint. The endpoint does not enforce authentication before processing incoming requests. Any client capable of reaching the CMS over the network can issue HTTP requests to the endpoint and receive a response.

Missing authentication [CWE-287] on a content management REST API allows attackers to enumerate, read, and potentially manipulate article resources. Because the endpoint is designed for network access, the exposure scales with the number of internet-facing Feehi CMS deployments. The public availability of exploitation details lowers the barrier for attackers.

EPSS data indicates a probability of 0.383% for exploitation activity in the near term, placing the CVE in the 30.285th percentile. The CWE-287 classification confirms that the root category is authentication, not authorization or input validation.

Root Cause

The root cause is the absence of an authentication check on the /api/articles route within the Feehi CMS REST API component. Requests reach the underlying controller logic without validation of session tokens, API keys, or user credentials. Access control is either not implemented or bypassed during route dispatch.

Attack Vector

An attacker sends an HTTP request directly to the /api/articles endpoint on a network-reachable Feehi CMS instance. No credentials, session cookies, or CSRF tokens are required. The attack requires no user interaction and can be scripted for mass exploitation across exposed hosts. Exploit code has been made public, as noted in the VulDB Vulnerability Details.

For technical specifics on the exposed endpoint behavior, refer to the GitHub Issue Discussion tracking the reported flaw.

Detection Methods for CVE-2026-13546

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to the /api/articles path in web server access logs
Requests to /api/articles originating from unknown IP addresses without prior authentication events
Unexpected modifications to article content or metadata in the Feehi CMS database
High-volume enumeration patterns targeting sequential article IDs on the REST API endpoint

Detection Strategies

Deploy web application firewall (WAF) rules that alert on requests to /api/articles lacking authentication headers or session cookies
Correlate REST API access logs with authentication logs to identify requests bypassing the login flow
Baseline normal request patterns to /api/articles and alert on anomalous request rates or source diversity

Monitoring Recommendations

Enable verbose HTTP access logging on all Feehi CMS front-end web servers
Forward web server and application logs to a centralized SIEM for correlation and retention
Monitor GitHub issue tracker liufee/cms/issues/87 for maintainer updates and patch availability

How to Mitigate CVE-2026-13546

Immediate Actions Required

Restrict network access to the /api/articles endpoint using firewall rules or reverse proxy allow-lists until a patch is released
Place Feehi CMS behind an authenticating reverse proxy that enforces credentials before requests reach the application
Audit existing article content for unauthorized modifications introduced through the exposed endpoint
Take internet-facing Feehi CMS instances offline if hosted content is business-critical and cannot be protected by network controls

Patch Information

No official patch is available at the time of publication. The project maintainers of liufee/cms were informed through a GitHub issue but have not responded. Monitor the VulDB CVE Record and the GitHub Issue Discussion for updates on vendor remediation.

Workarounds

Block requests to /api/articles at the reverse proxy or WAF layer for all unauthenticated clients
Restrict the CMS backend to trusted internal networks using VPN or IP allow-listing
Apply HTTP basic authentication at the web server level (nginx or Apache) as a compensating control in front of the REST API
Disable the REST API component if it is not required for the deployment's use case

bash

# Example nginx configuration to require authentication in front of the exposed endpoint
location /api/articles {
    auth_basic "Restricted API";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://feehi_cms_backend;
}