[HIGH] Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information

PKSA-mqv7-zr7q-hc9j CVE-2026-32300 GHSA-qr6x-wvxr-8hm9

Affected version: >=2.0.0,<=2.41.0|<=1.41.0

Reported by:
GitHub

[MEDIUM] Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin

PKSA-h93g-m9xg-91qb CVE-2026-32279 GHSA-jh46-85jr-6ph9

Affected version: >=2.0.0,<=2.41.0|<=1.41.0

Reported by:
GitHub

[HIGH] Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin

PKSA-2kyx-vx1v-bbq2 CVE-2026-32278 GHSA-mv3p-7p89-wq9p

Affected version: >=2.0.0,<=2.41.0|<=1.41.0

Reported by:
GitHub

[HIGH] Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View

PKSA-16v9-y28z-87sk CVE-2026-32277 GHSA-cmfh-mpmf-fmq4

Affected version: >=2.35.0,<2.41.1|>=1.35.0,<1.41.1

Reported by:
GitHub

[HIGH] Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin

PKSA-41bx-mcct-sk3j CVE-2026-32276 GHSA-hxqw-6qv7-cqfv

Affected version: >=2.0.0,<2.41.1|<1.41.1

Reported by:
GitHub