Skip to content
CVE PROGRAM SOURCE RECORD9.4 Critical

CVE-2026-16337

Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated ba

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
dotCMS

Description

Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote code execution via a crafted OSGi bundle upload whose BundleActivator executes arbitrary shell commands.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

dotCMS dotCMS

Default version status: unaffected

  • 21.02 to ≤ 26.06.22-03affected

References