Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Connect CMS: Unauthorized Access to Private Website Content

CVE-2026-32299 · published 7 months ago
Summary

A security flaw in Connect CMS allows unauthorized access to private website content, which could lead to sensitive information being exposed. This affects versions 1.x and 2.x of Connect CMS, released before 1.41.1 and 2.41.1 respectively. To fix the issue, update to the latest version of Connect CMS, 1.41.1 or 2.41.1.

What to do
  • Update opensource-workshop connect-cms to version 1.41.1.
  • Update opensource-workshop connect-cms to version 2.41.1.
Affected software
Ecosystem VendorProductAffected versions
composer opensource-workshop connect-cms <= 1.40.0
>= 2.0.0, <= 2.40.0
Fix: upgrade to 1.41.1
– opensource-workshop connect-cms >= 1.0.0, < 1.41.1
>= 2.0.0, < 2.41.1
cpe:2.3:a:opensource-workshop:connect-cms:*:*:*:*:*:*:*:*
Original advisory text
Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the page content retrieval feature may allow retrieval of non-public information. Versions 1.41.1 and 2.41.1 contain a patch.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published23 Mar 2026
Updated3 Nov 2026
First seen23 Mar 2026
Sources
GHSA-62ch-j6x7-722j · GHSA
CVE-2026-32299 · NVD
CVE-2026-32299 · OSV
Track software like this
Free during beta