CVE-2026-35183
Brave CMS has an Insecure Direct Object Reference in Article Image Deletion
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
8th
Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the article image deletion feature. It is located in app/Http/Controllers/Dashboard/ArticleController.php within the deleteImage method. The endpoint accepts a filename from the URL but does not verify ownership. This allows an authenticated user with edit permissions to delete images attached to articles owned by other users. This vulnerability is fixed in 2.0.6.
| CWE | CWE-639 |
| Vendor | ajax30 |
| Product | bravecms-2.0 |
| Published | Apr 6, 2026 |
| Last Updated | Apr 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for ajax30 bravecms-2.0
Be the first to know when new high vulnerabilities affecting ajax30 bravecms-2.0 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
Affected Versions
Ajax30 / BraveCMS-2.0
< 2.0.6