CVE-2026-32299: 
PHP vulnerability analysis and mitigation

CVE-2026-32299 is an improper authorization vulnerability in Connect-CMS, an open-source content management system developed by opensource-workshop, that allows unauthenticated remote attackers to retrieve non-public page content and attachments. It affects all 1.x series versions up to and including 1.41.0 and all 2.x series versions up to and including 2.41.0. The vulnerability was disclosed on March 23, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Security Advisory).

The root cause is insufficient authorization checks (CWE-284: Improper Access Control) within the page content retrieval feature of Connect-CMS. Specifically, certain code paths associated with non-public pages can be triggered without proper verification that the requesting party has permission to access those pages, allowing processing of restricted content to proceed. The attack requires no authentication, no user interaction, and no special privileges — an attacker need only send a crafted network request to the vulnerable endpoint to trigger the flaw. The vulnerability was reported by Sho Odagiri of GMO Cybersecurity by Ierae, Inc. (Security Advisory, Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to access the contents and file attachments of pages that have been designated as non-public within the Connect-CMS instance. The impact is limited to confidentiality — there is no integrity or availability impact — but the exposed data may include sensitive organizational information, internal documents, or restricted files intended only for authorized users. There is no evidence of lateral movement potential or system-level compromise, but the information disclosed could facilitate further targeted attacks (Security Advisory, Github Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.047% (15th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this CVE (Github Advisory).

The vendor has released patched versions addressing this vulnerability: 1.41.1 for the 1.x series and 2.41.1 for the 2.x series, both published on March 23, 2026. Users should upgrade to these versions or later immediately. No configuration-based workarounds have been published; upgrading is the only recommended remediation (Security Advisory, v1.41.1 Release, v2.41.1 Release).

The vulnerability was credited to Sho Odagiri (小田切 祥) of GMO Cybersecurity by Ierae, Inc., who responsibly disclosed it to the Connect-CMS maintainers. The advisory was published simultaneously with the patch release on March 23, 2026, and received routine coverage from vulnerability tracking services including VulDB, CVEFeed, and CIRCL. No notable researcher commentary or significant social media discussion beyond standard aggregation has been identified (Security Advisory).