Is this vulnerability remotely exploitable?

Yes. Any attacker who can reach the Connect-CMS web interface and send crafted HTTP requests to the My Page profile update endpoints may attempt to exploit the issue. In many real-world setups, this includes remote users over the internet or corporate networks.

Does an attacker need to be authenticated to exploit this?

In most practical scenarios, having at least a low-privileged account significantly increases exploitability, since the flaw involves profile update functionality that is typically available only to logged-in users. However, the exact requirement depends on how the instance exposes the My Page feature and whether any misconfigurations allow unauthenticated access.

What is the safest general fix pattern for developers and maintainers?

The most robust fix is to enforce ownership and role checks in a centralized authorization layer: derive the profile being updated from the authenticated session when modifying a user's own data and require explicit administrative roles for any cross-account changes. Avoid using client-provided user IDs as the sole basis for choosing which record to update.

Severity:

HIGH RISK

(8.1)

Improper Authorization (CWE-285) in Connect-CMS My Page Profile Update

CVE-2026-32300

Published:

Mar 23, 2026

Status:

Received

Summary

Affected Context

Exploit Preconditions

Why This Happens

Potential Impact

General Mitigation Guidance

How Teams Detect Issues Like This

Frequently Asked Questions

Source

NDV

Recent Vulnerabilities

CWE-74;CWE-89

HIGH RISK

HIGH

(7.3)

SQL Injection (CWE-89) in SourceCodester Online Catering Reservation /search.php

Data Exposure and Database Compromise

March 23, 2026

CWE-74;CWE-89

HIGH RISK

HIGH

(7.3)

SQL Injection (CWE-89) in Search Parameter of SourceCodester E-Commerce Site /products.php

Data Exposure and Integrity Compromise via SQL Injection

March 23, 2026

Vulnerability Type

Category:

Improper Authorization

CWE:

CWE-285;CWE-639

Impact:

Account Compromise / Unauthorized Data Modification

Severity:

HIGH RISK

(8.1)

CVSS Version:

3.1

Vulnerability Type

Category:

Improper Authorization

CWE:

CWE-285;CWE-639

Impact:

Account Compromise / Unauthorized Data Modification

Severity:

HIGH RISK

(8.1)

CVSS Version:

3.1

Catch This CVE While Code Is Being Written

Detect vulnerable code directly in pull requests, so CVEs are fixed before merge.

Get Started

Ship clean & secure code faster

START 14 DAYS FREE TRIAL

BOOK A DEMO

Made with Love in San Francisco

355 Bryant St. San Francisco, CA 94107, USA

Ask AI for summary of CodeAnt

Made with Love in San Francisco

355 Bryant St. San Francisco, CA 94107, USA

Ask AI for summary of CodeAnt

Made with Love in San Francisco

355 Bryant St. San Francisco, CA 94107, USA

Ask AI for summary of CodeAnt

Improper Authorization (CWE-285) in Connect-CMS My Page Profile Update

Summary

Affected Context

Exploit Preconditions

Why This Happens

Potential Impact

General Mitigation Guidance

How Teams Detect Issues Like This

Frequently Asked Questions

Source

Recent Vulnerabilities

HIGH RISK

HIGH

(7.3)

SQL Injection (CWE-89) in SourceCodester Online Catering Reservation /search.php

HIGH RISK

HIGH

(7.3)

SQL Injection (CWE-89) in Search Parameter of SourceCodester E-Commerce Site /products.php

Vulnerability Type

Vulnerability Type

Vulnerability Type

Catch This CVE While Code Is Being Written

Ship clean & secure code faster

Product

Pricing

Company

Legal

Developers

Compare

Product

Pricing

Company

Legal

Developers

Compare

Product

Pricing

Company

Legal

Developers

Compare