Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Brave CMS is an open-source CMS. Prior to 2.0.6, this vulnerability is a missing authorization check found in the update role endpoint at routes/web.php. The POST route for /rights/update-role/{id} lacks the checkUserPermissions:assign-user-roles middleware. This allows any authenticated user to change account roles and promote themselves to Super Admin. This vulnerability is fixed in 2.0.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
[CVE-2026-35182: HIGH] Vulnerability in Brave CMS (prior to 2.0.6) allows any authenticated user to change roles and promote to Super Admin. Update to 2.0.6 for the fix. #cybersecurity#cve,CVE-2026-35182,#cybersecurity https://cvefind.com/CVE-2026-35182
Post summary
CVE-2026-35182 enables authenticated users to claim Super Admin privileges; patch to Brave CMS 2.0.6 is available.
🚨*CVE* CVE-2026-35182 Brave CMS is an open-source CMS. Prior to 2.0.6, this vulnerability is a missing authorization check found in the update role endpoint at routes/web.php. The POST rou… https://www.cve.org/CVERecord?id=CVE-2026-35182 ----- Traducción: CVE-2026-35182 Bra… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-35182, describing a missing authorization check in Brave CMS’s update role endpoint, but provides no PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-35182 Brave CMS is an open-source CMS. Prior to 2.0.6, this vulnerability is a missing authorization check found in the update role endpoint at routes/web.php. The POST rou… https://www.cve.org/CVERecord?id=CVE-2026-35182
Post summary
The post informs about a missing authorization check in Brave CMS’s update role endpoint (CVE‑2026‑35182) affecting versions prior to 2.0.6, with no mention of PoC, exploit tools, active attacks, patches, or debunking.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ajax30 | bravecms | - | - | - |