CVE-2026-120185— ken678 YznCMS Auth Group Group.php Backend privileges management

Quick assessment

Affected

ken678 YznCMS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 ken678 开发的 YznCMS 2.2.0 及以下版本中发现了一个安全漏洞。受影响的组件为“用户组处理器（Auth Group Handler）”，具体位于文件中的函数。攻击者通过恶意操作可引发权限管理不当的问题，且该攻击可远程发起。升级至 2.2.1 版本即可修复此漏洞，对应的修复补丁编号为。建议立即升级受影响的组件。

CVSS 4.7 · Medium Updated Nov 01, 2026

Possible ATT&CK Techniques 3 AI

T1078 · Valid Accounts T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Affected Version Matrix 4

Vendor	Product	Version Range	Status
ken678	YznCMS	`2.0`	affected
		`2.1`	affected
		`2.2.0`	affected
		`2.2.1`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ken678 YznCMS Auth Group Group.php Backend privileges management

Source: CVE Program / CVE List V5

Vulnerability Description

A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated remotely. Upgrading to version 2.2.1 is sufficient to fix this issue. The patch is named ed16cd7f7f73e0316ffa8a148d. You should upgrade the affected component.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

特权管理不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ken678	YznCMS	2.0	`cpe:2.3:a:yzncms:yzncms::::::::`

II. Public POCs for CVE-2026-120185

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120185

请登录查看更多情报信息。

Other References for CVE-2026-120185 (7)

https://gitee.com/ken678/YZNCMS/ product
https://gitee.com/ken678/YZNCMS/commit/ed16cd7f7f73e0316ffa8a148d patch
https://gitee.com/ken678/YZNCMS/tree/v2.2.1 patch
https://vuldb.com/cve/CVE-2026-120185 third-party-advisory
https://vuldb.com/vuln/429502/cti signature permissions-required
https://vuldb.com/submit/1026603 third-party-advisory
https://vuldb.com/vuln/429502 vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-120185

IV. Related Vulnerabilities

Same weakness: CWE-269