CVE-2026-93504: SveltyCMS Authentication Bypass Vulnerability

CVE-2026-93504 Overview

CVE-2026-93504 is an improper access control vulnerability in SveltyCMS 0.0.6. The flaw resides in the User Attribute Update Endpoint implemented in src/routes/api/[...path]/+server.ts. An authenticated remote attacker can manipulate the endpoint to modify privileged user attributes such as role and isAdmin, resulting in privilege escalation. The weakness is classified under CWE-266: Incorrect Privilege Assignment. The maintainers addressed the issue in commit 05b4f9efeb79e9d72a693232334d7529687f896f, which introduces a fail-closed policy that strips privileged fields from client payloads before they reach the persistence layer.

Critical Impact

A low-privileged authenticated user can escalate to administrator by injecting privileged fields into user attribute update requests, gaining full control of the SveltyCMS instance.

Affected Products

• SveltyCMS 0.0.6
• SveltyCMS versions prior to commit 05b4f9efeb79e9d72a693232334d7529687f896f
• Deployments exposing the /api/[...path]/+server.ts User Attribute Update Endpoint

Discovery Timeline

• 2026-09-18 - CVE-2026-93504 published to NVD
• 2026-09-23 - CVE-2026-93504 last updated in NVD database

Technical Details for CVE-2026-93504

Vulnerability Analysis

SveltyCMS exposes a catch-all API route at src/routes/api/[...path]/+server.ts that handles user attribute updates. The endpoint accepts a JSON payload from the authenticated client and forwards attribute fields to the authentication adapter without filtering privileged keys. An attacker with a standard user session can add role: "admin" or isAdmin: true to a legitimate profile update request. The server persists these values, granting the caller administrative rights on the next authorization check.

The patch introduces stripPrivilegedUserFields(), a fail-closed policy that removes role and isAdmin from client payloads at both the handler layer in auth.ts and the adapter layer. This defense-in-depth approach ensures that a bypass at one layer does not translate into privilege escalation at the persistence layer.

Root Cause

The root cause is missing server-side authorization on writable user attributes. The endpoint trusts client-supplied JSON keys and forwards the entire object to the update handler. There is no allow-list of user-modifiable properties and no separation between self-service profile fields and administrative role fields.

Attack Vector

Exploitation requires only a valid low-privileged account and network access to the SveltyCMS API. The attacker issues a standard profile update request and appends privileged fields to the payload. No user interaction is required, and the attack succeeds in a single HTTP request.

// Patch summary from commit 05b4f9efeb79e9d72a693232334d7529687f896f
Security: remediate GHSA vulnerabilities (Privilege Esc, XSS, SSRF)

Privilege Escalation (CWE-269):
- Implemented `stripPrivilegedUserFields()` policy to drop `role`
  and `isAdmin` from client payloads.
- Enforced fail-closed privilege dropping at both the handler
  (`auth.ts`) and adapter layers.

Defense-in-Depth & Testing:
- Gated GraphQL Subscriptions requiring `context.user` auth.
- Added AST static scanner rules (`scan-security-risk.ts`) for
  `ssrf-unguarded-fetch` and `privilege-adapter-unguarded`.
- Expanded `bun run test:security` suite with 28+ regression cases.

Source: GitHub Commit 05b4f9ef

Detection Methods for CVE-2026-93504

Indicators of Compromise

• HTTP PATCH or POST requests to /api/* paths containing role or isAdmin fields in the JSON body from non-admin sessions.
• Unexpected changes in the user store where standard accounts suddenly hold the admin role.
• Audit log entries showing administrative actions performed by accounts that were not provisioned with elevated privileges.

Detection Strategies

• Inspect application logs for user attribute update requests that include privileged keys and correlate with the requesting session's authorization level.
• Deploy a web application firewall rule that flags request bodies to SveltyCMS API paths containing "role" or "isAdmin" when the caller is not an administrator.
• Run the bun run test:security regression suite introduced in the patch to confirm privileged field stripping is active.

Monitoring Recommendations

• Alert on privilege changes to any user account and require out-of-band verification for role promotions.
• Baseline API traffic to /api/[...path]/+server.ts and flag payloads containing fields outside the expected profile schema.
• Monitor for enumeration patterns where the same session repeatedly attempts user attribute updates with varying JSON keys.

How to Mitigate CVE-2026-93504

Immediate Actions Required

• Upgrade SveltyCMS to a build that includes commit 05b4f9efeb79e9d72a693232334d7529687f896f or later.
• Audit the user database for accounts with unexpected admin or elevated role values and revoke unauthorized privileges.
• Rotate session tokens and force re-authentication for all users after remediation.

Patch Information

The fix is available in commit 05b4f9efeb79e9d72a693232334d7529687f896f in the SveltyCMS GitHub repository. It adds the stripPrivilegedUserFields() policy enforced at both the handler (auth.ts) and adapter layers, ensuring role and isAdmin are dropped from client payloads before persistence. Additional details are available in the VulDB entry for CVE-2026-93504.

Workarounds

• Place SveltyCMS behind a reverse proxy that strips role and isAdmin keys from JSON bodies sent to /api/* endpoints.
• Restrict access to the User Attribute Update Endpoint using network segmentation or authenticated ingress rules until the patch is applied.
• Temporarily disable self-service profile updates in the SveltyCMS configuration if patching cannot be completed immediately.

# Example: pull the patched commit and rebuild
git fetch origin
git checkout 05b4f9efeb79e9d72a693232334d7529687f896f
bun install
bun run test:security
bun run build