# CVE-2026-38930: OpenRapid RapidCMS authentication bypass in menu.php

Source: https://junglewise.ai/threats/cve-2026-38930-openrapid-rapidcms-authentication-bypass-in-menu-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-38930 · Severity: info · CVSS 9.8 · Published 2026-05-27

OpenRapid RapidCMS, a content management system, contains a security flaw that allows unauthorized individuals to bypass login screens. By sending a specially crafted web request with a manipulated cookie, an attacker can gain full access to the system as a registered user. This could lead to unauthorized data access, website defacement, or complete administrative takeover.

Technologies: [OpenRapid RapidCMS](https://junglewise.ai/threats/technologies/rapidcms). Vendors: [OpenRapid](https://junglewise.ai/threats/vendors/openrapid).

## Quick answers

**Is CVE-2026-38930 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-38930 being exploited in the wild.

**How severe is CVE-2026-38930?** Informational severity, with a CVSS score of 9.8, published 27 May 2026.

**Which products and versions are affected?** OpenRapid RapidCMS 1.3.1.

**Is there a fix for CVE-2026-38930?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-38930 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-38930?** Check whether you run OpenRapid RapidCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass vulnerability exists in OpenRapid RapidCMS v1.3.1 within the /template/default/menu.php component. The vulnerability is caused by insufficient sanitization of the 'name' cookie parameter, which is used directly in a database query. An unauthenticated attacker can perform a SQL injection (e.g., using a UNION SELECT payload) to control the query results. By combining this injection with the application's known 'encode()' function logic, an attacker can generate a valid 'user' cookie that matches the injected 'name' value, effectively bypassing the authentication check and gaining access to the system.

## Affected products

- OpenRapid RapidCMS 1.3.1

## Timeline

- 2026-05-27: disclosed: Vulnerability details and PoC published by MOwORN
- 2026-05-27: advisory: CVE-2026-38930 published

## References

- [http://openrapid.com/](http://openrapid.com/)
- [http://rapidcms.com/](http://rapidcms.com/)
- [https://moworn.github.io/post/cve-2026-38930/](https://moworn.github.io/post/cve-2026-38930/)

## Related threats

- [OpenRapid RapidCMS Cross-Site Scripting in user-move.php](https://junglewise.ai/threats/cve-2025-64047-openrapid-rapidcms-cross-site-scripting-in-user-move-php)
- [OpenRapid RapidCMS XSS in update-run.php](https://junglewise.ai/threats/cve-2025-64046-openrapid-rapidcms-xss-in-update-run-php)