# CVE-2026-13544: Feehi CMS improper access control in UserController API

Source: https://junglewise.ai/threats/cve-2026-13544-feehi-cms-improper-access-control-in-usercontroller-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-13544 · Severity: medium · CVSS 6.3 · Published 2026-06-29

Feehi CMS, a content management system, contains a security flaw in its user management interface. An attacker with a standard user account can exploit this to view private information of other users, such as email addresses, or even delete other user accounts entirely. This could lead to significant data loss, privacy breaches, and disruption of service for the affected organization.

## Quick answers

**Is CVE-2026-13544 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13544 being exploited in the wild.

**How severe is CVE-2026-13544?** Medium severity, with a CVSS score of 6.3, published 29 June 2026.

**Which products and versions are affected?** Feehi CMS Up to 2.1.1.

**Is there a fix for CVE-2026-13544?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13544 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-13544?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Feehi CMS up to version 2.1.1 is vulnerable to improper access control and Insecure Direct Object Reference (IDOR) within the UserController component of its REST API. The vulnerability exists in the /api/users and /api/v1/users endpoints. While these endpoints require authentication, they fail to implement proper role-based access control (RBAC) or permission checks. Consequently, any user with a valid access token can perform GET requests to enumerate all registered users' personally identifiable information (PII)—including emails and account statuses—or issue DELETE requests to remove arbitrary user accounts. As of the advisory date, the vendor has not responded to the issue reports, and no official patch is available. Security engineers are advised to manually restrict these API methods to administrative roles.

## Affected products

- Feehi CMS Up to 2.1.1

## Timeline

- 2026-05-29: disclosed: Issue reported to the project via GitHub issues 88 and 89.
- 2026-06-29: advisory: CVE-2026-13544 published.

## References

- [https://github.com/liufee/cms/issues/88](https://github.com/liufee/cms/issues/88)
- [https://github.com/liufee/cms/issues/89](https://github.com/liufee/cms/issues/89)
- [https://vuldb.com/cve/CVE-2026-13544](https://vuldb.com/cve/CVE-2026-13544)
- [https://vuldb.com/submit/842582](https://vuldb.com/submit/842582)
- [https://vuldb.com/submit/842595](https://vuldb.com/submit/842595)
- [https://vuldb.com/submit/842602](https://vuldb.com/submit/842602)
- [https://vuldb.com/vuln/374552](https://vuldb.com/vuln/374552)