# CVE-2026-29002: CouchCMS privilege escalation via f_k_levels_list parameter tampering

Source: https://junglewise.ai/threats/cve-2026-29002-couchcms-privilege-escalation-via-f-k-levels-list-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-10. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-29002 · Severity: high · CVSS 7.2 · Published 2026-04-10

CouchCMS, a content management system for web designers, contains a security flaw that allows users with standard administrative access to grant themselves or others full 'SuperAdmin' control. By intercepting and modifying a specific setting during account creation, an attacker can bypass the software's intended restrictions on privilege levels. This could lead to a total takeover of the website, allowing the attacker to access sensitive data, modify any content, or lock out other legitimate administrators.

Technologies: [Couchcms](https://junglewise.ai/threats/technologies/couchcms). Vendors: [Couchcms](https://junglewise.ai/threats/vendors/couchcms).

## Quick answers

**Is CVE-2026-29002 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29002 being exploited in the wild.

**How severe is CVE-2026-29002?** High severity, with a CVSS score of 7.2, published 10 April 2026.

**Which products and versions are affected?** Couchcms <= 2.4.0.

**Is there a fix for CVE-2026-29002?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-29002 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-29002?** Check whether you run Couchcms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in CouchCMS versions up to and including 2.4.0 due to insufficient server-side validation of user-controlled keys. An authenticated user with 'Admin' privileges can bypass authorization restrictions by intercepting the HTTP request during user creation and modifying the 'f_k_levels_list' parameter. By changing this value from a standard user level (e.g., 4) to the SuperAdmin level (10), the application processes the request and creates a high-privileged account. This allows an attacker to circumvent the intended application logic that restricts SuperAdmin creation to existing SuperAdmins only, resulting in full application compromise.

## Affected products

- CouchCMS CouchCMS <= 2.4.0

## Timeline

- 2026-04-10: advisory: Initial advisory published by VulnCheck
- 2026-04-10: disclosed: Researcher disclosure by Piyush Kumar Shukla

## References

- [https://gist.github.com/thepiyushkumarshukla/477e2d2bbbe8cc3ec0d640c50f0cf9e1](https://gist.github.com/thepiyushkumarshukla/477e2d2bbbe8cc3ec0d640c50f0cf9e1)
- [https://www.couchcms.com/](https://www.couchcms.com/)
- [https://www.vulncheck.com/advisories/couchcms-privilege-escalation-via-f-k-levels-list-parameter](https://www.vulncheck.com/advisories/couchcms-privilege-escalation-via-f-k-levels-list-parameter)

## Related threats

- [CouchCMS persistent XSS via SVG file upload in KCFinder](https://junglewise.ai/threats/cve-2021-47955-couchcms-persistent-xss-via-svg-file-upload-in-kcfinder)
- [CouchCMS SSRF via SVG upload in browse.php](https://junglewise.ai/threats/cve-2021-47958-couchcms-ssrf-via-svg-upload-in-browse-php)
- [A security flaw has been discovered in CouchCMS up to 2.4. Affected is an unknown function of the file…](https://junglewise.ai/threats/cve-2025-15005-a-security-flaw-has-been-discovered-in-couchcms-up-to-2-4)