CVE-2026-95263: Feehi CMS Authentication Bypass Vulnerability

CVE-2026-95263 Overview

CVE-2026-95263 is an incorrect access control vulnerability in Feehi CMS 2.1.1. A low-privilege backend administrator holding the administrator-update permission can change the password of the built-in super administrator account. The application does not enforce protection for the super administrator account during password updates, and the update workflow does not require submission of the current password. An attacker leveraging an authenticated low-privilege account can take over the top-level account and gain full control of the CMS.

Critical Impact

An authenticated low-privilege backend user can seize the super administrator account, resulting in full compromise of site content, user data, and server-side configuration.

Affected Products

• Feehi CMS 2.1.1
• Earlier Feehi CMS releases that share the vulnerable administrator update workflow
• Deployments based on the upstream liufee/cms codebase

Discovery Timeline

• 2026-10-05 - CVE-2026-95263 published to the National Vulnerability Database (NVD)
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-95263

Vulnerability Analysis

Feehi CMS implements a role-based permission model that grants selected backend users the administrator-update capability for routine account management. The password update handler treats the built-in super administrator account like any other user record. It does not verify that the target account is privileged above the caller, and it does not require the old password as a confirmation factor. A low-privilege administrator can therefore submit a password change request against the super administrator user and succeed. After the change, the attacker authenticates as the super administrator and inherits the highest privilege level in the application. The flaw is classified under [CWE-284: Improper Access Control].

Root Cause

The update scenario in the user management controller lacks two controls. First, it omits a hierarchy check that would block modifications targeting an account with higher privileges than the caller. Second, it skips an old-password confirmation step that would prevent silent takeover of another user's account.

Attack Vector

Exploitation requires an authenticated session with the administrator-update permission and network reach to the backend. The attacker submits a crafted password update request against the super administrator user identifier. No user interaction, social engineering, or memory corruption primitive is required. Technical details are documented in the GitHub CVE-2026-95263 Advisory and the upstream Feehi CMS Repository.

Detection Methods for CVE-2026-95263

Indicators of Compromise

• Password change events in Feehi CMS audit logs where the actor holds administrator-update but the target account is the super administrator.
• Unexpected successful logins to the super administrator account from new IP addresses or user agents immediately after a password reset event.
• HTTP POST requests to the backend user update endpoint referencing the super administrator user identifier originating from non-super-admin sessions.

Detection Strategies

• Correlate web server access logs with application audit logs to flag password updates where the acting user ID does not match the target user ID and the target is the super administrator.
• Alert on any modification of the super administrator record from sessions that are not themselves authenticated as the super administrator.
• Baseline the volume and timing of administrator password changes and alert on deviations.

Monitoring Recommendations

• Forward Feehi CMS application logs and web server logs to a centralized analytics platform for correlation and retention.
• Monitor authentication events for the super administrator account and require review of every successful login.
• Track role and permission grants of administrator-update and review assignments on a recurring schedule.

How to Mitigate CVE-2026-95263

Immediate Actions Required

• Audit all accounts that currently hold the administrator-update permission and revoke the grant from users who do not require it.
• Rotate the super administrator password and enable multi-factor authentication at the reverse proxy or identity layer if available.
• Restrict network access to the Feehi CMS backend using IP allowlists or a VPN until a vendor patch is applied.

Patch Information

No vendor-released patch is referenced in the NVD entry at the time of publication. Monitor the upstream Feehi CMS Repository for commits that add a privilege hierarchy check and require the current password during administrator updates. Apply any released fix promptly and retest the password update workflow against the super administrator account.

Workarounds

• Remove the administrator-update permission from all roles except the super administrator role.
• Place the backend administration path behind an authenticating reverse proxy that enforces strong authentication and source IP restrictions.
• Apply a local code modification to the user update controller that rejects requests whose target user holds privileges greater than or equal to the acting user.

# Configuration example: restrict backend access at the reverse proxy (nginx)
location /admin/ {
    allow 10.0.0.0/8;
    deny all;
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://feehi_cms_upstream;
}