CVE-2026-16337

Name of the Vulnerable Software and Affected Versions dotCMS versions 21.02 through 26.06.22-03

Description Improper authorization in the 'ToolGroupResource' and 'RoleAjax' REST/DWR endpoints allows a low-privileged authenticated backend user to self-assign the administrative layout and grant themselves the CMS Administrator role. This privilege escalation enables remote code execution through the upload of a crafted OSGi bundle, where the BundleActivator executes arbitrary shell commands. OSGi (Open Service Gateway initiative) is a Java framework for developing modular components.

Recommendations Update dotCMS to a version later than 26.06.22-03. Restrict access to the 'ToolGroupResource' and 'RoleAjax' endpoints to prevent unauthorized privilege escalation.