CVE-2026-120185

MEDIUM 4.7

ken678 YznCMS Auth Group Group.php Backend privileges management

CVSS Score

4.7

EPSS Score

0.0%

EPSS Percentile

0th

A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated remotely. Upgrading to version 2.2.1 is sufficient to fix this issue. The patch is named ed16cd7f7f73e0316ffa8a148d. You should upgrade the affected component.

CWE	CWE-269 CWE-266
Vendor	ken678
Product	yzncms
Published	Oct 31, 2026

Stay Ahead of the Next One

Get instant alerts for ken678 yzncms

Be the first to know when new medium vulnerabilities affecting ken678 yzncms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

ken678 / YznCMS

2.0 2.1 2.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/429502 vuldb.com: https://vuldb.com/vuln/429502/cti vuldb.com: https://vuldb.com/cve/CVE-2026-120185 vuldb.com: https://vuldb.com/submit/1026603 gitee.com: https://gitee.com/ken678/YZNCMS/commit/ed16cd7f7f73e0316ffa8a148d gitee.com: https://gitee.com/ken678/YZNCMS/tree/v2.2.1 gitee.com: https://gitee.com/ken678/YZNCMS/

Credits

🔍 danieluec (VulDB User)