CVE-2026-29002

CVE-2026-29002 is a privilege escalation vulnerability in CouchCMS that allows authenticated Admin-level users to create SuperAdmin accounts by manipulating the f_k_levels_list parameter during user creation requests. Attackers can modify this parameter value from 4 to 10 in HTTP request bodies to bypass authorization controls and obtain full application access, effectively circumventing intended restrictions on SuperAdmin account creation. The vulnerability has a CVSS 3.1 score of 7.2 (HIGH) with a network-based attack vector, low attack complexity, and high privileges required. The impact is severe, resulting in high confidentiality, integrity, and availability compromises. The EPSS score of 0.00042 indicates this threat is currently uncommon relative to the broader CVE landscape, though this should not diminish its severity in affected environments. There is no evidence of active exploitation or public exploit code availability at this time. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains inactive on threat tracking lists. However, organizations running CouchCMS should prioritize assessment and patching, as the straightforward nature of the parameter manipulation attack could enable rapid exploitation if adversaries gain knowledge of the flaw.