CVE-2026-35183 Ajax30 CVE debrief

Who should care

Users of Brave CMS, particularly those with edit permissions, should be aware of this vulnerability and take steps to mitigate it by updating to version 2.0.6 or later. Security teams and platform operators should review affected deployments and ensure proper security controls are in place.

Technical summary

The IDOR vulnerability in Brave CMS allows an authenticated user with edit permissions to delete images attached to articles owned by other users. This is possible because the endpoint accepts a filename from the URL but does not verify ownership. The vulnerability is fixed in version 2.0.6. Technical details: the vulnerability is located in the deleteImage method within the ArticleController.php file. No exploit details are publicly available.

Defensive priority

High

Recommended defensive actions

• Update Brave CMS to version 2.0.6 or later
• Restrict access to the article image deletion feature
• Monitor for suspicious activity related to article image deletion
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-06T20:16:26.727Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability affects Brave CMS versions prior to 2.0.6. Evidence of exploitation is not currently available. Defenders should verify affected deployments and review official advisories.

Official resources