CVE-2026-5251
Medium · 6.3CVSS
6.3
EPSS
0.4%
Published
Apr 1, 2026
CISA due date
—
The record
A vulnerability was identified in z-9527 admin 1.0/2.0. This impacts an unknown function of the file /server/routes/user.js of the component User Update Endpoint. Such manipulation of the argument isAdmin with the input 1 leads to dynamically-determined object attributes. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-92953 vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer… CWE-913
- CVE-2026-92955 vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers… CWE-913
- CVE-2026-92946 vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is… CWE-913
- CVE-2026-92935 vm2 is a sandbox for running untrusted Node.js code. CWE-913
- CVE-2026-65181 Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with… CWE-913
- CVE-2026-41870 Missing Authorization, Improper Control of Generation of Code ('Code Injection')… CWE-913
- CVE-2026-84430 A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. CWE-913
- CVE-2026-59283 Applications that evaluate Spring Expression Language (SpEL) expressions using… CWE-913