CVE-2023-53923 UliCMS 2023.1 Privilege Escalation via Unauthenticated Admin Account Creation

What is CVE-2023-53923?

CVE-2023-53923 is a critical vulnerability in Ulicms, published on 17 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController endpoint. Attackers can send a crafted POST request to /dist/admin/index.php with specific parameters to generate a new admin user with full system access.

Weakness: CWE-862

Which versions are affected by CVE-2023-53923?

It affects 1 product.

Products include Ulicms Ulicms.

How do I fix CVE-2023-53923?

No fix has been published for CVE-2023-53923 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-53923 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-53923 exists.

Other vulnerabilities in Ulicms

• CVE-2023-53914 UliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability Critical 9.3
• CVE-2023-53924 UliCMS 2023.1-sniffing-vicuna Remote Code Execution via Avatar Upload High 8.7
• CVE-2020-12703 Cross-site scripting in n/a Medium 6.1
• CVE-2020-12704 Cross-site scripting in n/a Medium 6.1
• CVE-2019-11398 Cross-site scripting in n/a Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-33jq-r57w-5666.