Is CVE-2026-29002 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-29002 being exploited in the wild.

How severe is CVE-2026-29002?

High severity, with a CVSS score of 7.2, published 10 April 2026.

Is there a fix for CVE-2026-29002?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-29002 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-29002?

Check whether you run Couchcms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29002: CouchCMS privilege escalation via f_k_levels_list parameter tampering

CVE-2026-29002 · Severity: high · CVSS 7.2 · Published 2026-04-10

CouchCMS, a content management system for web designers, contains a security flaw that allows users with standard administrative access to grant themselves or others full 'SuperAdmin' control. By intercepting and modifying a specific setting during account creation, an attacker can bypass the software's intended restrictions on privilege levels. This could lead to a total takeover of the website, allowing the attacker to access sensitive data, modify any content, or lock out other legitimate administrators.

Technologies: Couchcms. Vendors: Couchcms.

Quick answers

Is CVE-2026-29002 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-29002 being exploited in the wild.
How severe is CVE-2026-29002?: High severity, with a CVSS score of 7.2, published 10 April 2026.
Which products and versions are affected?: Couchcms <= 2.4.0.
Is there a fix for CVE-2026-29002?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-29002 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-29002?: Check whether you run Couchcms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in CouchCMS versions up to and including 2.4.0 due to insufficient server-side validation of user-controlled keys. An authenticated user with 'Admin' privileges can bypass authorization restrictions by intercepting the HTTP request during user creation and modifying the 'f_k_levels_list' parameter. By changing this value from a standard user level (e.g., 4) to the SuperAdmin level (10), the application processes the request and creates a high-privileged account. This allows an attacker to circumvent the intended application logic that restricts SuperAdmin creation to existing SuperAdmins only, resulting in full application compromise.

Affected products

CouchCMS CouchCMS <= 2.4.0

Timeline

2026-04-10: advisory: Initial advisory published by VulnCheck
2026-04-10: disclosed: Researcher disclosure by Piyush Kumar Shukla

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.