← Back

CVE-2026-35183

nvd nist
Published: Apr 6, 2026Modified: Apr 14, 2026

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Exploitability: 2.8 / Impact: 2.5
Source: NVD

Description

Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the article image deletion feature. It is located in app/Http/Controllers/Dashboard/ArticleController.php within the deleteImage method. The endpoint accepts a filename from the URL but does not verify ownership. This allows an authenticated user with edit permissions to delete images attached to articles owned by other users. This vulnerability is fixed in 2.0.6.

Affected (1)

Products: Ajax30: Bravecms
Ajax30
1 product
Bravecms
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Bravecms
From 2.0.0 to 2.0.6

Related CWEs

CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (1)

Source: security-advisories@github.com
ExploitVendor Advisory

Timeline

No history available yet.