code-projects Simple Content Management System: Missing Authorization (CVE-2026-116623)
An authorization bypass vulnerability in the Admin Interface of code-projects Simple Content Management System 1.0 allows remote attackers to manipulate the addnews argument to perform unauthorized actions.
CVE search metadata
CVE search record: CVE-2026-116623. Severity: high. CVSS: 7.3. KEV: no. Product: Simple Content Management System (1.0). Brief: code-projects Simple Content Management System: Missing Authorization (CVE-2026-116623). Brief link: https://feed.craftedsignal.io/briefs/2026-10-simple-cms-auth-bypass/
Triage facts
Revision 1- Applicability
- Simple Content Management System (1.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 01:52 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-116623 describes a missing authorization vulnerability in code-projects Simple Content Management System version 1.0. The vulnerability resides in '/web/admin/welcome.php' within the Admin Interface component. Attackers can remotely exploit this by manipulating the 'addnews' argument. Public exploit code is available for this vulnerability.
Impact
Successful exploitation allows for unauthorized manipulation of administrative functions, specifically regarding the addition of content within the CMS, potentially leading to unauthorized data entry or administrative control depending on the context of the affected function.
Recommendation
- Inventory all instances of code-projects Simple Content Management System in the environment.
- Prioritize restricting access to the '/web/admin/' directory via web server configuration to trusted management IPs.
- Monitor web server access logs for anomalous POST or GET requests targeting '/web/admin/welcome.php' containing the 'addnews' parameter.
Immediate actions
Restrict external access to /web/admin/ via web application firewall or server configuration
Threat Hunt
Identify requests to /web/admin/welcome.php with addnews parameter
Data: web server access logs (cs-uri-stem, cs-uri-query)