Executive brief
CouchCMS, a content management system for web designers, contains a security flaw that allows users with standard administrative access to grant themselves or others full 'SuperAdmin' control. By intercepting and modifying a specific setting during account creation, an attacker can bypass the software's intended restrictions on privilege levels. This could lead to a total takeover of the website, allowing the attacker to access sensitive data, modify any content, or lock out other legitimate administrators.
Technical details
A privilege escalation vulnerability exists in CouchCMS versions up to and including 2.4.0 due to insufficient server-side validation of user-controlled keys. An authenticated user with 'Admin' privileges can bypass authorization restrictions by intercepting the HTTP request during user creation and modifying the 'f_k_levels_list' parameter. By changing this value from a standard user level (e.g., 4) to the SuperAdmin level (10), the application processes the request and creates a high-privileged account. This allows an attacker to circumvent the intended application logic that restricts SuperAdmin creation to existing SuperAdmins only, resulting in full application compromise.
Affected products
- CouchCMS CouchCMS <= 2.4.0
Timeline
- 2026-04-10: advisory: Initial advisory published by VulnCheck
- 2026-04-10: disclosed: Researcher disclosure by Piyush Kumar Shukla