CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 10, 2026 · NIST NVD

   Detected

   CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass authorization validation and gain full application control, circumventing restrictions on SuperAdmin accoun

2. Jul 14, 2026 · NIST NVD

   Updated

   CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass authorization validation and gain full application control, circumventing restrictions on SuperAdmin accoun

Affected

• cpe couchcms/couchcmsversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-29002

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-29002

  CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request bo

  nvd.nist.gov

References

• Exploit · gist.github.com
• Product · couchcms.com
• Third Party Advisory · vulncheck.com