PT-2026-120917

CVE-2026-114544

Published

2026-10-21

Updated

2026-10-30

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Media Bulk Upload versions 0.0.0 through 3.0.6

Description An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify user permissions when creating specific media types if the bulk upload form is configured for those types. Exploitation requires the attacker to possess a role with the "bulk upload form" permission.

Recommendations Update Media Bulk Upload to a version later than 3.0.6.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors