Executive brief
SveltyCMS is a headless content management system used by developers to manage website content. The User Attribute Update API endpoint in version 0.0.6 contains an access control flaw that allows attackers to modify user attributes and potentially escalate privileges. This could result in unauthorized account takeovers or administrative access gains.
Technical details
The vulnerability exists in the User Attribute Update Endpoint (src/routes/api/[...path]/+server.ts) and involves improper access controls on user attribute modifications. The flaw is classified as a privilege escalation issue (related to CWE-269) where the endpoint fails to properly restrict modification of sensitive user fields such as `role`, `isAdmin`, and other privileged attributes. The vulnerability is remotely exploitable without requiring prior authentication or special preconditions. Patch 05b4f9efeb79e9d72a693232334d7529687f896f implements `stripPrivilegedUserFields()` policy to drop privileged attributes from client payloads at both the handler and adapter layers, along with fail-closed privilege dropping mechanisms.
Affected products
- SveltyCMS SveltyCMS 0.0.6
Timeline
- 2026-09-18: disclosed
- 2026-08-07: patched: Patch commit 05b4f9efeb79e9d72a693232334d7529687f896f