Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-14y6-675h-rfex
Summary
funadmin has Incorrect Privilege Assignment in its Configuration Handler
A weakness has been identified in funadmin up to 7.1.0-rc4. This affects the function setConfig of the file app/backend/controller/Ajax.php of the component Configuration Handler. Executing a manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Aliases
0
alias CVE-2026-2896
1
alias GHSA-5m2g-4cf6-c3rg
Fixed_packages
Affected_packages
0
url pkg:composer/funadmin/funadmin@7.1.0-rc4
purl pkg:composer/funadmin/funadmin@7.1.0-rc4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-14y6-675h-rfex
1
vulnerability VCID-6ex5-r7ck-nkgu
2
vulnerability VCID-b9k4-kuhe-sug9
3
vulnerability VCID-bhzu-quhs-c3dh
4
vulnerability VCID-h19b-rapd-zyda
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/funadmin/funadmin@7.1.0-rc4
References
0
reference_url https://github.com/funadmin/funadmin
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value 5.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/funadmin/funadmin
1
reference_url https://github.com/I4m6da/CVE/issues/3
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value 5.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/I4m6da/CVE/issues/3
2
reference_url https://vuldb.com/?ctiid.347207
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value 5.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://vuldb.com/?ctiid.347207
3
reference_url https://vuldb.com/?id.347207
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value 5.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://vuldb.com/?id.347207
4
reference_url https://vuldb.com/?submit.753972
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value 5.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://vuldb.com/?submit.753972
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-2896
reference_id CVE-2026-2896
reference_type
scores
0
value 7.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value 5.5
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-2896
6
reference_url https://github.com/advisories/GHSA-5m2g-4cf6-c3rg
reference_id GHSA-5m2g-4cf6-c3rg
reference_type
scores
url https://github.com/advisories/GHSA-5m2g-4cf6-c3rg
Weaknesses
0
cwe_id 266
name Incorrect Privilege Assignment
description A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score4.0 - 7.3
Exploitability0.5
Weighted_severity6.6
Risk_score3.3
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-14y6-675h-rfex