CVE-2026-120185 Details
Description
A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated remotely. Upgrading to version 2.2.1 is sufficient to fix this issue. The patch is named ed16cd7f7f73e0316ffa8a148d. You should upgrade the affected component.
An improper privilege management vulnerability has been identified in ken678 YznCMS versions through 2.2.0. The issue arises in the Auth Group Handler component, specifically within the Backend function of the file app/admin/controller/auth/Group.php. This vulnerability allows for remote exploitation by manipulating the affected function.
Users can upgrade to YznCMS version 2.2.1 to address this vulnerability. The patch is available in the official repository on Gitee.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 31, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitee.com/ken678/YZNCMS/ | [email protected] | ProductVendor |
| https://gitee.com/ken678/YZNCMS/commit/ed16cd7f7f73e0316ffa8a148d | [email protected] | Source CodeVendor |
| https://gitee.com/ken678/YZNCMS/tree/v2.2.1 | [email protected] | Permission RequiredProductVendor |
| https://vuldb.com/cve/CVE-2026-120185 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1026603 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/429502 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/429502/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ken678 YznCMS | <= 2.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 31, 2026 | New CVE Received | [email protected] |