PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35183 Ajax30 CVE debrief

An Insecure Direct Object Reference (IDOR) vulnerability exists in the article image deletion feature of Brave CMS prior to 2.0.6. The vulnerability is located in the deleteImage method within the ArticleController.php file. An authenticated user with edit permissions can delete images attached to articles owned by other users. This could lead to unauthorized modification of article content. The vulnerability is fixed in version 2.0.6. Users should update to the latest version to mitigate this vulnerability.

Vendor
Ajax30
Product
BraveCMS-2.0
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-06
Original CVE updated
2026-07-24
Advisory published
2026-04-06
Advisory updated
2026-07-24

Who should care

Users of Brave CMS, particularly those with edit permissions, should be aware of this vulnerability and take steps to mitigate it by updating to version 2.0.6 or later. Security teams and platform operators should review affected deployments and ensure proper security controls are in place.

Technical summary

The IDOR vulnerability in Brave CMS allows an authenticated user with edit permissions to delete images attached to articles owned by other users. This is possible because the endpoint accepts a filename from the URL but does not verify ownership. The vulnerability is fixed in version 2.0.6. Technical details: the vulnerability is located in the deleteImage method within the ArticleController.php file. No exploit details are publicly available.

Defensive priority

High

Recommended defensive actions

  • Update Brave CMS to version 2.0.6 or later
  • Restrict access to the article image deletion feature
  • Monitor for suspicious activity related to article image deletion
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-06T20:16:26.727Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability affects Brave CMS versions prior to 2.0.6. Evidence of exploitation is not currently available. Defenders should verify affected deployments and review official advisories.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35183 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35183

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35183 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35183

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.