CVE-2026-35182

Brave CMS versions prior to 2.0.6 contain a missing authorization vulnerability in the role update endpoint that allows any authenticated user to modify account roles and escalate privileges to Super Admin. The vulnerability stems from an absent checkUserPermissions:assign-user-roles middleware on the POST route /rights/update-role/{id} in routes/web.php. The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) with a network attack vector, low complexity, and low privilege requirements. Impact is severe across confidentiality, integrity, and availability, enabling attackers to gain administrative control over the CMS and potentially compromise all protected data and functionality. There is currently no evidence of active exploitation in the wild, as indicated by absence from the Known Exploited Vulnerabilities catalog and inactive status on threat tracking lists. The EPSS score of 0.00038 suggests minimal real-world exploitation likelihood, though organizations should nevertheless prioritize updating to version 2.0.6 to eliminate the privilege escalation path available to any authenticated user.