CVE-2026-120185
Medium · 4.7CVSS
4.7
EPSS
0.2%
Published
Oct 31, 2026
CISA due date
—
The record
A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated remotely. Upgrading to version 2.2.1 is sufficient to fix this issue. The patch is named ed16cd7f7f73e0316ffa8a148d. You should upgrade the affected component.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121539 A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. CWE-266
- CVE-2026-121514 A weakness has been identified in EasySoft ZenTao PMS up to 22.6. CWE-266
- CVE-2026-119922 Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5… CWE-266
- CVE-2026-120224 A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. CWE-266
- CVE-2026-54854 Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. CWE-266
- CVE-2026-118086 Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. CWE-266
- CVE-2026-116386 Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. CWE-266
- CVE-2026-119599 AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows… CWE-266