CVE-2026-95263

Executive Summary

Feehi CMS 2.1.1 is affected by an Incorrect Access Control (CWE-284) flaw in which a low-privilege backend administrator holding the "administrator-update" permission can modify the password of the built-in super administrator account. The server does not enforce protection for this built-in account, and the password-update scenario does not require the current (old) password, allowing silent account takeover of the highest-privileged identity in the application. This results in full application compromise for any deployment running Feehi CMS 2.1.1 whenever a lower-tier administrative role can be obtained or already exists (insider, delegated staff, or compromised low-privilege account).

Technical Analysis

Feehi CMS is a PHP/MySQL content management system. The vulnerability resides in the user/administrator management functionality of the backend, specifically the "administrator-update" operation. The NVD description states that the server "does not enforce protection for this account" — meaning the built-in super administrator account is not treated as a protected or immovable object during update operations — and that "the update scenario does not require the old password."

Two distinct access-control failures combine here:

1. Missing privilege separation (vertical privilege escalation): A backend administrator with only the administrator-update permission is permitted to act on an account that holds a strictly higher privilege level (the built-in super administrator). There is no role-hierarchy check preventing a lower-privileged admin from modifying a higher-privileged account.
2. Missing current-credential verification (weak re-authentication): The password-change request path does not require the caller to supply the existing password of the target account. Normally a password reset/update flow requires the old password or a validated reset token, which prevents an unrelated party from silently rotating credentials.

The result is that the update endpoint accepts a request from an insufficiently privileged actor and applies a new password to the super administrator record without any ownership or re-authentication check. Because no forced session invalidation or notification is described, the change can be applied without the legitimate super administrator's awareness until they are locked out.

The attack surface is the authenticated backend administrative interface (HTTP/HTTPS), reachable by any user who has been granted backend administrative access at the lower tier. Exploitation does not require network adjacency — it is a remote, authenticated action (AV:N/PR:L per the inferred vector), which is why the integrity and confidentiality impact of a full super-administrator takeover is high.

No public PoC, Nuclei template, or exploit code is available for this CVE, and no CWE was assigned by NVD; the class is best characterized as Incorrect Access Control / improper authorization (CWE-284, with the missing re-authentication aspect aligning to CWE-620). Insufficient technical detail is available to name the specific controller, route, or parameter involved; the mechanism is therefore described at the vulnerability-class and control-failure level.

Exploitation Scenarios

The following chain is inferred from the vulnerability class and the NVD description; no public exploit exists.

1. Reconnaissance / target identification. An attacker identifies an internet- or intranet-exposed Feehi CMS 2.1.1 deployment. Backend administrative portals are located via content/title fingerprinting ("Feehi"/"Feehi CMS"). The attacker must already possess, or first obtain, valid backend administrative credentials at the lower privilege tier (for example, a delegated content or staff administrator account whose role includes the administrator-update permission). This prerequisite is what constrains the attacker to the authenticated, low-privilege context.

2. Triggering the flaw class. From the authenticated backend session, the attacker invokes the administrator-update operation against the record of the built-in super administrator account. Because the server performs no protection check on that built-in account and no privilege-hierarchy enforcement, the request is accepted. Because the update scenario does not require the old password, the attacker does not need to know or supply the super administrator's current password.

3. Execution method (vulnerability-class level). The attacker submits a new password value for the super administrator account through the update functionality. No specific endpoint path, parameter name, or function name is provided in the source data, so the concrete request format cannot be stated without fabrication. At the class level, this is a direct object reference combined with a broken authorization check: the actor supplies a target account identifier and a new credential, and the server applies it without verifying the actor's authority over that object or the target's current credential.

4. Post-exploitation impact. Having set a known password for the built-in super administrator account, the attacker authenticates as the super administrator and obtains the highest level of application privilege. This enables full administrative control of the CMS — content, users, roles, and any configuration or plugin functionality exposed to the super administrator — as well as the ability to persist by creating or modifying accounts (account manipulation, T1098). The legitimate super administrator is effectively locked out unless the change is detected and reversed out-of-band.

Impact Assessment

• Confidentiality: High. Super-administrator access exposes all application data and administrative functionality.
• Integrity: High. The attacker can alter content, users, roles, and configuration under the highest-privilege identity.
• Availability: High. Full administrative control permits destructive actions, including locking out the legitimate owner and disabling functionality.
• Privileges Required: Low (authenticated). The attacker needs an existing low-privilege backend admin account with the administrator-update permission.
• Attack Vector: Network. The update is performed over the backend HTTP interface.
• User Interaction: None for the victim super administrator in the described update scenario.

Business impact: Complete compromise of the CMS instance, including takeover of the highest-privileged account, leading to potential website defacement, data theft, injection of malicious content, and misuse of the CMS as a foothold. Blast radius is bounded to deployments of Feehi CMS 2.1.1 where a lower-tier administrative account is present or obtainable; enterprises exposing Feehi CMS backends to untrusted networks carry the greatest risk. Because no patch exists and the account itself is the attack target, any such deployment should be treated as having weak super-administrator protection.

Detection Guidance

Sigma Rule

title: Feehi CMS Unauthorized Super Administrator Password Change
id: 7c1e4d2a-9b3f-4a55-8e21-feehicms95263
status: experimental
description: Detects a password update applied to the built-in super administrator account from a lower-privileged backend administrator session in Feehi CMS 2.1.1.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95263
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: application
  product: feehi_cms
detection:
  selection_operation:
    event_type: 'administrator_update'
  selection_target:
    target_role: 'super_admin'
    action: 'password_change'
  condition: selection_operation and selection_target
falsepositives:
  - Legitimate super administrator-initiated password rotation
level: high
tags:
  - attack.t1098
  - attack.privilege_escalation

YARA Rule

rule Feehi_CMS_Admin_Password_Update_CVE_2026_95263
{
    meta:
        description = "Detects Feehi CMS 2.1.1 backend administrator update logic lacking super-admin protection and old-password enforcement"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95263"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ver  = "Feehi CMS" ascii wide nocase
        $upd1 = "administrator-update" ascii wide nocase
        $upd2 = "admin/update" ascii wide nocase
        $pwd1 = "password" ascii wide nocase
        $pwd2 = "old_password" ascii wide nocase
        $sa1  = "super_admin" ascii wide nocase

    condition:
        (uint16(0) == 0x3F3C or $ver) and
        ($upd1 or $upd2) and ($pwd1 or $pwd2 or $sa1)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-95263 Feehi CMS Potential Super Administrator Password Change"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"admin"; content:"update"; nocase; http.request_body; content:"password"; nocase; reference:cve,2026-95263; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-95263; classtype:attempted-admin; sid:202695263; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where event.action == "logon" and user.name != null ]
  [ any where event.action in ("password_change","account_update") and
    process.name != null and
    winlog.event_data.TargetUserName : "super_admin" ]

Splunk SPL Query

index=web OR index=cms sourcetype=feehi*
| search uri_path IN ("*admin*update*","*administrator*update*")
| where (request_method="POST")
| rex field=request_body "password=(?<new_password>[^&]+)"
| where isnotnull(new_password) AND match(target_account,"(?i)super")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths by src_ip, user
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="feehi_cms,web,access_control,">
  <rule id="202695263" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">administrator_update</field>
    <field name="target_role">super_admin</field>
    <field name="action">password_change</field>
    <description>CVE-2026-95263: Possible unauthorized super administrator password change in Feehi CMS (low-privilege admin modifying super admin).</description>
    <mitre>
      <id>T1098</id>
    </mitre>
    <group>privilege_escalation,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict backend administrative access: place the Feehi CMS backend behind an authenticated reverse proxy, IP allowlist, or VPN so that only trusted operators can reach the administrator-update functionality.
   • Apply least privilege: audit and remove the administrator-update permission from all non-essential and delegated administrative roles; keep the number of backend administrators to a minimum.
   • Enforce separation so that no lower-privileged role can act on the built-in super administrator account — implement a server-side protection check that blocks modification of that account by anyone other than the account itself.
   • Require current-credential (old password) verification for any password change and invalidate active sessions on credential change.
   • Monitor and alert on any change to the super administrator's password; treat unexpected changes as a security incident and rotate credentials immediately.

2. Patch / upgrade steps

   • No vendor patch, fixed version, or advisory is currently available from any tracked source. Monitor the Feehi CMS project channels and the NVD entry for CVE-2026-95263 for an official fix.
   • Until a fix is published, consider migrating the deployment to a maintained alternative CMS, or apply a custom code-level fix that (a) enforces a privilege-hierarchy check so a low-privilege admin cannot modify the built-in super administrator, and (b) requires the old password in the update scenario.

3. Long-term hardening

   • Adopt policy-as-code for role/permission definitions and review administrative role assignments regularly.
   • Enable centralized logging of all administrative account and permission changes, with automated alerting (see Detection Guidance).
   • Enforce multi-factor authentication and re-authentication for high-impact account operations.
   • Maintain a software inventory and patch-management process for CMS platforms; treat CMS backends as high-value, internet-restricted assets.

References

• NVD — CVE-2026-95263: https://nvd.nist.gov/vuln/detail/CVE-2026-95263
• MITRE ATT&CK T1098 — Account Manipulation: https://attack.mitre.org/techniques/T1098/
• MITRE CWE-284 — Improper Access Control: https://cwe.mitre.org/data/definitions/284.html
• Feehi CMS project repository (vendor project page): https://github.com/liufee/cms
• CISA Known Exploited Vulnerabilities catalog (checked — CVE-2026-95263 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, public PoC, Nuclei template, or exploit-in-the-wild evidence are associated with CVE-2026-95263 based on the data provided.