CVE-2026-120185 ken678 YznCMS Auth Group Group.php Backend privileges management
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-120185?
CVE-2026-120185 is a medium-severity vulnerability in ken678 YznCMS, published on 31 Oct 2026.
Official description
A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated remotely. Upgrading to version 2.2.1 is sufficient to fix this issue. The patch is named ed16cd7f7f73e0316ffa8a148d. You should upgrade the affected component.
Which versions are affected by CVE-2026-120185?
How do I fix CVE-2026-120185?
No fix has been published for CVE-2026-120185 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-120185 being exploited?
There is no known exploitation of CVE-2026-120185 in the wild and no public exploit code.
Sources
Also known as GHSA-r68q-24fh-c39p.