Executive brief
Feehi CMS, a content management system, contains a security flaw in its programming interface (API) used for managing articles. This vulnerability allows unauthorized individuals to bypass security checks and perform administrative actions without a password. An attacker could read private drafts, create new posts, or delete existing content, potentially leading to data loss or unauthorized website changes.
Technical details
A missing authentication vulnerability (CWE-306) exists in the ArticleController of Feehi CMS up to version 2.1.1. The REST API endpoint at /api/articles fails to implement authentication or access control checks, exposing full Create, Read, Update, and Delete (CRUD) functionality to unauthenticated users. A remote attacker can exploit this by sending crafted HTTP requests (GET, POST, PUT, DELETE) to the /api/articles or /api/articles/{id} endpoints. This allows for the retrieval of unpublished drafts, modification of existing content, or deletion of any article in the database. As of the advisory date, the vendor has not released a patch, though a mitigation involving overriding the behaviors() method in ArticleController has been suggested.
Affected products
- Feehi CMS Up to 2.1.1
Timeline
- 2026-05-29: disclosed: Issue reported on GitHub by security researcher
- 2026-06-29: advisory: NVD/VulDB advisory published