← Vulnerability feed

Vulnerability record · CVE-2026-67207 · published 30 July 2026

CVE-2026-67207: Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows…

Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the incorrect evaluation of the access control expression to create, download, and restore backups without administrative privileges.

8.7 CVSS 4.0 High EPSS 0.54% · top 56.9% CWE-697 · CWE-697 Deferred
8.7CVSS 4.0 base score
0.54%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
2References
31 Jul 2026Last modified by NVD

Description

Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the incorrect evaluation of the access control expression to create, download, and restore backups without administrative privileges.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

LinkTags
https://github.com/Caycon/cve-advisories/blob/main/2026/WolfCms/CVE-2026-67207.md
https://www.vulncheck.com/advisories/wolf-cms-authorization-bypass-via-backuprestorecontroller

Track CVE-2026-67207 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.2CVE-2024-5217ServiceNow Now Platform input validation flaw enables unauthenticated RCEServiceNow's Washington DC, Vancouver, and earlier Now Platform releases contain an input validation vulnerability (CWE-184 incomplete list of disall…KEVEPSS 100%analysed7.5CVE-2020-5849Unraid authentication bypass in version 6.8.0Unraid 6.8.0 contains an authentication bypass (CWE-697, incorrect comparison) that lets an unauthenticated remote party get past login checks. The r…KEVEPSS 93%analysed

Source: NIST National Vulnerability Database (record CVE-2026-67207), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.