Executive brief
Serendipity, a popular open-source weblog engine, is affected by a security flaw that allows users with 'Editor' permissions to take over 'Administrator' accounts. By renaming their own account to match an existing administrator's name, an attacker can log in with their own password but gain the full access rights of the administrator. This could lead to a complete compromise of the website, including the ability to modify content, access sensitive data, or shut down the service.
Technical details
The vulnerability is classified as authentication context confusion (CWE-304/CWE-287) due to the lack of a UNIQUE constraint on the username column in the database. The authentication process in serendipity_authenticate_author() validates the password against one record, but serendipity_load_userdata() subsequently loads session data based only on the username string. If two accounts share a username, the system may validate the password for the low-privileged account but load the session data for the high-privileged account. An authenticated Editor can exploit this by renaming their account to match an Administrator's username and logging in. The issue is resolved in Serendipity version 2.6.1.
Affected products
- s9y Serendipity < 2.6.1
Timeline
- 2026-07-27: advisory: GitHub Security Advisory published
- 2026-07-30: disclosed: CVE-2026-67351 published to NVD
- 2026-07-30: patched: Fix released in version 2.6.1