PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9376 JPress Projects CVE debrief

A low-severity improper authorization vulnerability exists in JPress versions up to 1.0.3. The affected endpoint is `/ucenter/article/doWriteSave` in the UCenter Article Submission component. Manipulation of the `id` or `userId` parameters can lead to unauthorized actions. The vulnerability is remotely exploitable, and proof-of-concept exploit details have been publicly disclosed. The project maintainers were notified via GitHub issue but had not responded as of the CVE publication date. The CVSS 4.0 vector indicates network attack vector with low attack complexity, requiring low privileges and no user interaction, with low impacts to confidentiality, integrity, and availability.

Vendor
JPress Projects
Product
JPress
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-24
Original CVE updated
2026-07-23
Advisory published
2026-05-24
Advisory updated
2026-07-23

Who should care

Organizations running JPress 1.0.3 or earlier with UCenter functionality enabled; security teams monitoring for authorization bypass vulnerabilities in Java-based content management systems; developers maintaining JPress deployments

Technical summary

The vulnerability resides in an unknown function within `/ucenter/article/doWriteSave` of JPress's UCenter Article Submission Endpoint. By manipulating the `id` or `userId` arguments, an authenticated attacker with low privileges can bypass intended authorization controls. The attack vector is network-based with low complexity. The vulnerability status is currently Deferred in NVD, indicating pending analysis or vendor coordination. No patch is available as of the modified date.

Defensive priority

low

Recommended defensive actions

  • Review and restrict access to the `/ucenter/article/doWriteSave` endpoint in JPress deployments
  • Validate and enforce authorization checks on `id` and `userId` parameters at the application layer
  • Monitor for unauthorized article submission attempts in application logs
  • Consider implementing additional access controls or Web Application Firewall rules for the affected endpoint
  • Track the referenced GitHub issue for vendor patch availability before upgrading

Evidence notes

Vulnerability identified through Vuldb submission and publicly disclosed via GitHub issue. CWE-266 (Incorrect Privilege Assignment) and CWE-285 (Improper Authorization) assigned. CVSS 4.0 score of 2.1 reflects limited impact scope. Exploit existence confirmed in public disclosure. Vendor notification status: unresponsive as of CVE publication.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9376 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9376

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9376 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9376

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.