CVE-2026-96772: Subrion CMS Information Disclosure Flaw

CVE-2026-96772 Overview

CVE-2026-96772 is an information disclosure vulnerability in Intelliants Subrion CMS versions up to 4.2.1. The flaw resides in the /actions.json?action=assign-owner endpoint, where manipulation of the q parameter leaks sensitive data to unauthenticated remote attackers. The vulnerability is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). A public exploit has been released, increasing the likelihood of opportunistic attacks against exposed Subrion CMS instances. The vendor was contacted ahead of disclosure but did not respond.

Critical Impact
Unauthenticated remote attackers can disclose sensitive information from vulnerable Subrion CMS deployments via a crafted request to the assign-owner action, with no user interaction required.

Affected Products

Intelliants Subrion CMS versions up to and including 4.2.1
Deployments exposing the /actions.json administrative action endpoint
Instances where the assign-owner action is reachable without authentication controls

Discovery Timeline

2026-09-24 - CVE-2026-96772 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-96772

Vulnerability Analysis

The vulnerability affects the Subrion CMS administrative action handler reachable through /actions.json?action=assign-owner. The handler processes a user-controlled q parameter without enforcing adequate authorization or output filtering. Attackers submit crafted values in q to retrieve data the application should not return in that context.

Because the endpoint is reachable over the network and requires neither credentials nor user interaction, exploitation can be fully automated. Public release of exploit details lowers the barrier for mass scanning and opportunistic abuse against internet-facing Subrion CMS deployments.

Root Cause

The root cause is improper restriction of information returned by the assign-owner JSON action. The code path accepts the q query parameter and returns records matching the attacker-supplied input without validating that the requester is authorized to view those records. This maps directly to [CWE-200]. The absence of a vendor patch means affected code remains unchanged in distributed releases.

Attack Vector

Exploitation is performed remotely over HTTP(S) by issuing a GET request to /actions.json?action=assign-owner&q=<value> on a vulnerable Subrion CMS host. The attacker iterates values in q to enumerate records, usernames, or other backend data exposed by the endpoint. See the GitHub Security Advisory and VulDB Vulnerability Details for the published proof-of-concept and request structure.

Detection Methods for CVE-2026-96772

Indicators of Compromise

HTTP requests to /actions.json with the action=assign-owner query parameter from unauthenticated or unexpected source addresses
Repeated requests varying only the q parameter value, indicative of enumeration or scraping
Elevated outbound response sizes from the /actions.json endpoint without a corresponding authenticated session

Detection Strategies

Build web server and WAF rules that alert on access to /actions.json?action=assign-owner outside of authenticated administrative sessions
Correlate access-log entries with session state to identify requests to the action handler without a valid admin cookie
Hunt for sequential or dictionary-style values in the q parameter across short time windows from the same source IP

Monitoring Recommendations

Forward Subrion CMS web server access logs to a centralized analytics platform for pattern analysis on the /actions.json endpoint
Alert on anomalous volumes of JSON responses from the administrative action handler
Track unique source IPs querying assign-owner and flag addresses associated with scanning infrastructure

How to Mitigate CVE-2026-96772

Immediate Actions Required

Restrict access to /actions.json at the web server or reverse-proxy layer so only authenticated administrators can reach the endpoint
Place internet-exposed Subrion CMS instances behind a WAF with rules blocking anonymous access to action=assign-owner
Review access logs for prior exploitation attempts matching the request pattern described in the public advisory

Patch Information

No vendor patch is available at the time of publication. The advisory notes the vendor did not respond to disclosure outreach. Monitor the GitHub Security Advisory and the VulDB CVE Database Entry for updates. Organizations should evaluate migrating off Subrion CMS given the lack of vendor engagement.

Workarounds

Enforce authentication on the entire /actions.json path through web server configuration (for example, nginxauth_basic or an application-layer gateway)
Block the assign-owner action at the WAF when the request originates from outside the administrative network range
Disable or firewall the Subrion CMS admin interface from the public internet and require VPN access for management

bash

# Example nginx configuration restricting the vulnerable endpoint
location ~* ^/actions\.json {
    allow 10.0.0.0/8;        # internal admin network
    deny  all;
    # Alternatively require authentication:
    # auth_basic           "Subrion Admin";
    # auth_basic_user_file /etc/nginx/.htpasswd;
}