Is CVE-2026-67351 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67351 being exploited in the wild.

How severe is CVE-2026-67351?

High severity, with a CVSS score of 8.8, published 30 July 2026.

Is there a fix for CVE-2026-67351?

A patch was published on 2026-07-30: Fix released in version 2.6.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67351 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-67351?

Check whether you run Serendipity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67351: Serendipity privilege escalation via authentication context confusion

CVE-2026-67351 · Severity: high · CVSS 8.8 · Published 2026-07-30

Serendipity, a popular open-source weblog engine, is affected by a security flaw that allows users with 'Editor' permissions to take over 'Administrator' accounts. By renaming their own account to match an existing administrator's name, an attacker can log in with their own password but gain the full access rights of the administrator. This could lead to a complete compromise of the website, including the ability to modify content, access sensitive data, or shut down the service.

Technologies: Serendipity. Vendors: Serendipity.

Quick answers

Is CVE-2026-67351 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67351 being exploited in the wild.
How severe is CVE-2026-67351?: High severity, with a CVSS score of 8.8, published 30 July 2026.
Which products and versions are affected?: Serendipity < 2.6.1.
Is there a fix for CVE-2026-67351?: A patch was published on 2026-07-30: Fix released in version 2.6.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67351 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-67351?: Check whether you run Serendipity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as authentication context confusion (CWE-304/CWE-287) due to the lack of a UNIQUE constraint on the username column in the database. The authentication process in serendipity_authenticate_author() validates the password against one record, but serendipity_load_userdata() subsequently loads session data based only on the username string. If two accounts share a username, the system may validate the password for the low-privileged account but load the session data for the high-privileged account. An authenticated Editor can exploit this by renaming their account to match an Administrator's username and logging in. The issue is resolved in Serendipity version 2.6.1.

Affected products

s9y Serendipity < 2.6.1

Timeline

2026-07-27: advisory: GitHub Security Advisory published
2026-07-30: disclosed: CVE-2026-67351 published to NVD
2026-07-30: patched: Fix released in version 2.6.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.