Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-96773: Subrion CMS login page may redirect users to unsafe sites
CVE-2026-96773 · published 25 days ago
Summary
The login page in Subrion CMS versions up to 4.2.1 can be tricked into sending visitors to a different web address chosen by an attacker. This could be used to lure users to phishing sites or install unwanted software. Update to a newer version or apply the vendor’s patch to stop the unwanted redirects.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| intelliants | subrion cms | 4.2.0 |
Original advisory text
Intelliants Subrion CMS Login Page login.php authorize redirect
A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $_SERVER['HTTP_REFERER'] causes open redirect. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-601Open Redirect
Timeline
Published24 Sep 2026
Updated19 Oct 2026
First seen24 Sep 2026
Track software like this
Free during beta