CVE-2026-5248: GouguCMS RCE Vulnerability

CVE-2026-5248 Overview

CVE-2026-5248 is a mass assignment vulnerability in gougucms version 4.08.18. The flaw exists in the reg_submit function within gougucms-master\app\home\controller\Login.php, which handles user registration. Attackers can manipulate the level argument during registration to dynamically set object attributes that should not be user-controllable. The issue is classified under [CWE-913] (Improper Control of Dynamically-Managed Code Resources). The vendor was contacted before public disclosure but did not respond. The exploit details have been published, making opportunistic abuse possible.

Critical Impact
Remote attackers with basic registration access can manipulate user object attributes — including privilege level — leading to potential account elevation in the gougucms application.

Affected Products

gougucms 4.08.18
Component: User Registration Handler (app\home\controller\Login.php)
Function: reg_submit

Discovery Timeline

2026-04-01 - CVE-2026-5248 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-5248

Vulnerability Analysis

The vulnerability stems from improper handling of user-supplied input in the registration workflow. The reg_submit function in Login.php accepts request parameters and binds them directly to object attributes without filtering. This pattern, commonly known as mass assignment, allows attackers to overwrite fields that the application does not intend to expose to clients. In gougucms, the level parameter controls a user's authorization tier. An attacker submitting a registration request with a crafted level value can influence privileged attributes during account creation. The flaw maps to [CWE-913], dynamically-determined object attributes, where the application fails to enforce an allowlist of writable fields.

Root Cause

The root cause is the absence of input filtering between the HTTP request and the model layer. The reg_submit handler passes user-controlled data into object attribute assignment without restricting which fields can be set. Sensitive attributes such as level remain writable from the registration endpoint.

Attack Vector

The vulnerability is exploitable remotely over the network. An attacker submits a registration request to the public registration endpoint and includes an additional level parameter in the POST body. The application persists the supplied value into the new user record. Authentication is not required to reach the registration handler. Full technical details are documented in the thinhneee mass assignment write-up and tracked in VulDB #354429.

No verified proof-of-concept code is reproduced here. Review the linked technical references for exploitation details.

Detection Methods for CVE-2026-5248

Indicators of Compromise

Registration POST requests to the gougucms /home/login/reg_submit endpoint containing unexpected parameters such as level, is_admin, or other privileged field names.
New user accounts created with elevated level values where the application UI does not provide that option.
Unusual sequences of self-service registration followed by access to administrative routes.

Detection Strategies

Inspect web server and application logs for registration requests carrying fields outside the expected schema (username, password, email).
Compare new user records against a baseline of expected default attribute values for self-registered accounts.
Deploy a web application firewall rule that blocks or alerts on registration requests containing privileged parameter names.

Monitoring Recommendations

Audit the gougu_admin user table periodically to flag accounts whose level does not match the registration default.
Forward gougucms access logs to a centralized log platform and alert on anomalous parameter combinations on registration endpoints.
Monitor for first-time logins from newly registered accounts that immediately access administrative functionality.

How to Mitigate CVE-2026-5248

Immediate Actions Required

Disable public user registration on gougucms 4.08.18 until a vendor patch is available.
Apply input filtering in app\home\controller\Login.php so reg_submit accepts only username, password, and email fields.
Review existing user accounts and reset the level attribute on any account that should not hold elevated privileges.

Patch Information

No official vendor patch is available at the time of publication. According to the disclosure references, the vendor did not respond to outreach. Track VulDB #354429 and the project's repository for any future fixes. Apply the workarounds below in the interim.

Workarounds

Modify reg_submit to explicitly assign only allowlisted fields to the user model rather than passing the entire request payload.
Place gougucms registration endpoints behind a reverse proxy that strips unexpected parameters from POST bodies.
Require administrator approval for any newly registered account before granting access to authenticated functionality.

bash

# Example WAF rule (ModSecurity) to block mass-assignment on registration
SecRule REQUEST_URI "@contains /home/login/reg_submit" \
  "id:1026248,phase:2,deny,status:403,log,\
   msg:'CVE-2026-5248 mass assignment attempt',\
   chain"
  SecRule ARGS_NAMES "@rx ^(level|is_admin|role|admin)$" \
    "t:lowercase"