Executive brief
JPress, an open-source content management system, contains a security flaw in its article submission system. An authenticated user can potentially modify or overwrite articles belonging to other users by manipulating the article ID during the save process. This could lead to unauthorized changes to website content and damage the integrity of user-generated data.
Technical details
An improper authorization vulnerability (CWE-285/CWE-639) exists in JPress up to version 1.0.3 within the UCenter article update functionality. The endpoint 'POST /ucenter/article/doWriteSave' fails to sufficiently verify article ownership when an existing article ID is provided in the request. An attacker with a low-privileged account can manipulate the 'id' or 'userId' parameters to trigger an update flow on articles they do not own. This occurs because the 'ArticleUCenterController.doWriteSave()' method lacks a server-side check to ensure the 'oldArticle.getUserId()' matches the 'currentUser.getId()' before executing the 'saveOrUpdate' operation. As of the advisory date, the project has been informed via a GitHub issue but has not yet released a formal patch.
Affected products
- JPressProjects JPress 1.0.3
Timeline
- 2026-05-12: disclosed: Issue reported on JPress GitHub repository
- 2026-05-24: advisory: CVE published and VulDB entry created