CVE-2026-44392 Details
Description
Missing authorization vulnerability exists in Movable Type. Under certain conditions, when a user without administrator privileges signs in to the product, unintended update processing may be executed.
A missing authorization vulnerability has been identified in Movable Type. This issue occurs when a user without administrator privileges logs into the application under certain conditions, potentially allowing the execution of unintended update processes. The vulnerability affects multiple versions of Movable Type, including the 9.1.0 and earlier (9.1 series), 9.0.6 and earlier (9.0 series), 8.8.2 and earlier (8.8 series), and 8.0.9 and earlier (8.0 series). Additionally, Movable Type Premium and its Advanced Edition are affected in the 9.1.0 and earlier (9.1 series) and 9.0.6 and earlier (9.0 series) versions. Movable Type Premium (MT8-based) versions 2.14 and earlier are also vulnerable. Furthermore, several end-of-support products are impacted, including Movable Type versions 5.1 to 5.18, 5.2, 6.0 through 6.8.8, 7 r.4207 to r.5510, and 8.4.0 to 8.4.4. Movable Type Premium 1.0 to 1.68 is also affected.
Users can update to the latest version of Movable Type or Movable Type Premium. For Movable Type, versions 9.0.8, 8.8.4, and 8.0.11 are available. Movable Type Premium users can upgrade to versions 9.0.8 or 2.16. For those using an end-of-support product, no update is available, and it is recommended to upgrade to a supported version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 20, 2026CISA-ADP
Assessed May 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://jvn.jp/en/jp/JVN66473735/ | [email protected] | AdvisoryBundleRemedy |
| https://movabletype.org/news/2026/05/mt-908-released.html | [email protected] | Release NotesVendor |
| https://www.sixapart.jp/movabletype/news/2026/05/20-1100.html | [email protected] | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Six Apart Ltd. Movable Type | <= 9.1.0 (semver) <= 9.0.6 (semver) ~2.14 ~1.0 |
CPE
Remediation
| |
| Six Apart Ltd. Movable Type Advanced | All versions |
CPE
Remediation
| |
| Six Apart Ltd. Movable Type Premium | All versions |
CPE
Remediation
| |
| Six Apart Ltd. Movable Type Premium Advanced Edition | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | New CVE Received | [email protected] |