CVE-2026-23923

The record

An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.

Affected packages

Related vulnerabilities

• CVE-2026-114660 Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in… CWE-470
• CVE-2026-112145 A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. CWE-470
• CVE-2026-78030 DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and… CWE-470
• CVE-2026-76825 RestrictedPython is a tool that helps define a subset of the Python language for… CWE-470
• CVE-2026-79987 A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp… CWE-470
• CVE-2026-41871 Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code… CWE-470
• CVE-2026-41870 Missing Authorization, Improper Control of Generation of Code ('Code Injection')… CWE-470
• CVE-2026-58400 GeoNetwork is a catalog application to manage spatially referenced resources. CWE-470