CVE-2026-120185
ken678 YznCMS Auth Group Group.php Backend privileges management
What happened?
A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated remotely. Upgrading to version 2.2.1 is sufficient to fix this issue. The patch is named ed16cd7f7f73e0316ffa8a148d. You should upgrade the affected component.
Affected software and versions
| Software | Version information | Fixed version |
|---|---|---|
| YznCMSken678 | affected: 2.0; affected: 2.1; affected: 2.2.0; unaffected: 2.2.1 | See vendor advisory |
Version information comes from the source record and can include unaffected products and exceptions. Distribution packages may contain backported fixes: an older upstream version alone does not prove a server is affected.
Is it being exploited?
This CVE was not listed in the CISA catalogue at our last retrieval. This does not establish that exploitation is absent.
How to respond
- Confirm the product, installed package version, and any configuration requirements in the vendor advisory.
- Follow the vendor’s remediation or workaround guidance in the references below. Structured fixed-version data is unavailable here; the publisher’s description may include a fix or workaround.
- Restart affected services if required, then verify the running version. Known exploitation may warrant investigation as well as patching.
Sources and remediation references
- https://www.cve.org/CVERecord?id=CVE-2026-120185
- https://vuldb.com/vuln/429502
- https://vuldb.com/vuln/429502/cti
- https://vuldb.com/cve/CVE-2026-120185
- https://vuldb.com/submit/1026603
- https://gitee.com/ken678/YZNCMS/commit/ed16cd7f7f73e0316ffa8a148d
- https://gitee.com/ken678/YZNCMS/tree/v2.2.1
- https://gitee.com/ken678/YZNCMS/