CVE-2026-29002

CouchCMS Privilege Escalation via f_k_levels_list Parameter

CVSS 8.6 HIGHEPSS 0.4%CWE-639

Vexday Risk Score

41Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 8.6EPSS 0.4%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

10 Apr 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass authorization validation and gain full application control, circumventing restrictions on SuperAdmin account creation and privilege assignment.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

CouchCMS · CouchCMS

public PoCs found — 1

cve_referencegist.github.com/thepiyushkumarshukla/477e2d2bbbe8cc3ec0d640c50f0cf9e1unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://gist.github.com/thepiyushkumarshukla/477e2d2bbbe8cc3ec0d640c50f0cf9e1 https://www.couchcms.com/https://www.vulncheck.com/advisories/couchcms-privilege-escalation-via-f-k-levels-list-parameter