Executive brief
Brave CMS is an open-source content management system used to build and manage websites. A security flaw allows any logged-in user, even those with the lowest level of access, to grant themselves full administrative privileges. This could lead to a total takeover of the website, allowing an attacker to steal data, modify content, or delete the entire site.
Technical details
A missing authorization check exists in Brave CMS versions prior to 2.0.6 within the role update functionality. Specifically, the POST route for '/rights/update-role/{id}' in 'routes/web.php' fails to implement the 'checkUserPermissions:assign-user-roles' middleware. An authenticated attacker with low-level privileges can exploit this by sending a crafted POST request to the endpoint to modify their own 'role_id' or that of others. Successful exploitation results in vertical privilege escalation to 'Super Admin', granting full control over the CMS environment. The issue is resolved in version 2.0.6 by applying the appropriate middleware to the affected route.
Affected products
- Ajax30 BraveCMS-2.0 >= 2.0.0, < 2.0.6
Timeline
- 2026-04-01: advisory: GitHub Security Advisory published by vendor
- 2026-04-06: disclosed: CVE published to NVD
- 2026-04-06: patched: Fix released in version 2.0.6