VULNERABILITY INTELLIGENCE

CVE-2021-26598

CVSS score5.3 MEDIUM

EPSS probability10.53%

CISA KEVNot currently listed

Published2022-03-28

Last modified2026-06-17

Description

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).