PT-2026-33629

CVE-2026-6571

Published

2026-04-19

Updated

2026-04-19

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions KodExplorer versions prior to 4.53

Description A weakness in the roleGroupAction() function within the '/app/controller/systemRole.class.php' file allows for remote authorization bypass. This occurs through the manipulation of the group role argument.

Recommendations Update to a version newer than 4.52. As a temporary workaround, restrict access to the roleGroupAction() function in the '/app/controller/systemRole.class.php' file.

Exploitability

Exploit

Fix

Impacts

Researchers

Vulnplusbot

Vendors

Affected products

Weakness enumeration

CWE-285: Improper Authorization

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers