Executive brief
ZwiiCMS, a database-less content management system, is vulnerable to a flaw that allows low-privileged users to block administrators from accessing management pages. By simply attempting to visit an administrative link, a user can trigger a resource lock that prevents others from using that feature. This can lead to a denial-of-service where legitimate administrators are unable to manage the website until the attacker's session ends.
Technical details
A denial-of-service vulnerability exists in ZwiiCMS due to improper locking (CWE-667) and incorrect authorization (CWE-863) in administrative endpoints. When an authenticated user with low privileges attempts to access an administrative page, the application correctly returns a 404 error but incorrectly initiates a resource lock associated with that user's session before verifying their permissions. This lock persists and prevents other users, including high-privileged administrators, from accessing the same resource. The condition lasts until the attacker's session is terminated or they navigate away. The issue is resolved in version 13.7.00.
Affected products
- fredtempez ZwiiCMS < 13.7.00
Timeline
- 2025-12-31: disclosed
- 2025-12-31: advisory
- 2025-12-31: patched: Fixed in version 13.7.00