CVE-2026-77116 Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview
Logged-in users can access unpublished popup content by manipulating post IDs, exposing sensitive data to unauthorized subscribers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-77116?
CVE-2026-77116 is a medium-severity missing authorization vulnerability in Unknown Brave, published on 23 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL.
Weakness: CWE-639
Which versions are affected by CVE-2026-77116?
How do I fix CVE-2026-77116?
No fix has been published for CVE-2026-77116 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-77116 being exploited?
There is no known exploitation of CVE-2026-77116 in the wild and no public exploit code.
Sources
Also known as GHSA-3pv4-5j2g-fvvj.