theinfosecnews
theinfosecnews
Subscribe to Daily Digest

CVE-2026-35183

Published April 7, 2026 · Updated April 7, 2026

7.1CVSS
high

What This Means

CVE-2026-35183 is a high-severity Insecure Direct Object Reference (IDOR) vulnerability found in the Brave CMS prior to version 2.0.6. This vulnerability allows authenticated users with edit permissions to delete images from articles they do not own, posing a risk of unauthorized data deletion. Update Brave CMS to version 2.0.6 or later to mitigate this vulnerability.

Official Description+

Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the article image deletion feature. It is located in app/Http/Controllers/Dashboard/ArticleController.php within the deleteImage method. The endpoint accepts a filename from the URL but does not verify ownership. This allows an authenticated user with edit permissions to delete images attached to articles owned by other users. This vulnerability is fixed in 2.0.6.

Recommended Actions

  1. Check if your systems use any of the affected products listed above.
  2. Apply vendor patches immediately if available.
  3. Monitor vendor advisories for updates and additional mitigations.
  4. Review logs for indicators of compromise related to CVE-2026-35183.

Related Coverage