CVE-2026-30452

CVE-2026-30452 is a Broken Access Control vulnerability in Textpattern CMS version 4.9.0 that permits authenticated users with low privileges to modify articles owned by higher-privileged users. The flaw exists in the article management system's duplicate-and-save workflow within textpattern/include/txp_article.php, where improper authorization checks allow attackers to manipulate article ID parameters and overwrite content belonging to other users. The vulnerability carries a CVSS score of 6.5 (MEDIUM severity) with a network-based attack vector requiring low privileges and no user interaction. The attack has no impact on confidentiality or availability but results in high integrity compromise, allowing unauthorized modification of article content. This represents a significant risk to content management systems where editorial control and data integrity are critical. Exploitation status is currently low, with no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog, and community attention remains minimal. However, organizations running Textpattern CMS 4.9.0 should prioritize patching this flaw to prevent privilege escalation and unauthorized content modification by low-privileged users.