Executive brief
Feehi CMS, a content management system, contains a security flaw in its user management interface. An attacker with a standard user account can exploit this to view private information of other users, such as email addresses, or even delete other user accounts entirely. This could lead to significant data loss, privacy breaches, and disruption of service for the affected organization.
Technical details
Feehi CMS up to version 2.1.1 is vulnerable to improper access control and Insecure Direct Object Reference (IDOR) within the UserController component of its REST API. The vulnerability exists in the /api/users and /api/v1/users endpoints. While these endpoints require authentication, they fail to implement proper role-based access control (RBAC) or permission checks. Consequently, any user with a valid access token can perform GET requests to enumerate all registered users' personally identifiable information (PII)—including emails and account statuses—or issue DELETE requests to remove arbitrary user accounts. As of the advisory date, the vendor has not responded to the issue reports, and no official patch is available. Security engineers are advised to manually restrict these API methods to administrative roles.
Affected products
- Feehi CMS Up to 2.1.1
Timeline
- 2026-05-29: disclosed: Issue reported to the project via GitHub issues 88 and 89.
- 2026-06-29: advisory: CVE-2026-13544 published.