Description

A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-31T02:17:03.003Z",
  "pubdate": "2026-08-31T02:17:03.003Z",
  "executiveSummary": "A critical authorization bypass vulnerability has been identified in SeaCMS versions up to 13.6. This vulnerability resides within the /ass.php file and allows remote, unauthenticated attackers to circumvent established security controls.\nThe vulnerability type is classified as an improper authorization mechanism, which potentially enables unauthorized users to access restricted functions or sensitive data handled by the vulnerable script.\nThe impact is significant, as it grants attackers the ability to manipulate application logic without prior authentication. The security risk is elevated by the fact that exploit details have been publicly disclosed, increasing the likelihood of opportunistic exploitation in the wild.\nAffected systems are limited to installations of SeaCMS versions 13.6 and earlier. Organizations utilizing this software are at risk of unauthorized administrative actions or data exposure. Successful exploitation does not require advanced access levels, as the flaw originates from an authentication check failure that can be triggered remotely over a network.",
  "technicalDetails": "The vulnerability is situated within the /ass.php component of SeaCMS. The root cause is a flawed authorization logic that fails to properly validate the session or user privileges before executing sensitive code paths. By interacting with /ass.php, an attacker can bypass the security barriers intended to guard internal application functionality.\nThe exploitation method relies on the failure of the application to enforce strict access control checks on incoming requests directed at the /ass.php file. Under normal operations, the application should verify the identity and permission level of the requester before processing the request. However, due to the identified vulnerability, the application processes requests regardless of the authentication state of the initiator.\nThe attack flow proceeds as follows: An attacker sends a specially crafted HTTP request to the /ass.php endpoint. Since the underlying code fails to verify the existence of a valid session token or administrative privilege level, the application treats the request as legitimate. The attacker effectively bypasses the authentication gateway, allowing for the execution of functions that were intended only for privileged administrators.\nThe vulnerable component is identified as /ass.php. This file appears to act as a controller or handler for specific administrative or system-related tasks. Because the bypass is triggered at the entry point of the script, the entire execution flow of /ass.php is compromised.\nThis vulnerability is reachable remotely over the network, meaning no local access or physical proximity to the server is required for an attacker to initiate the exploit. The exploit is currently public, implying that attackers can leverage existing proof-of-concept scripts to automate the identification and exploitation of vulnerable SeaCMS instances.\nThe post-exploitation impact includes, but is not limited to, unauthorized access to sensitive application data, execution of unauthorized administrative commands, and the potential for full system compromise if the functionality within /ass.php provides access to broader application settings or file system operations. The lack of authentication requirements turns this into a high-risk security event for any exposed SeaCMS installation."
}