CVE-2026-96773

EUVD-2026-85760
A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $_SERVER['HTTP_REFERER'] causes open redirect. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Open Redirect
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulDBCNA
4.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 16.38%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
intelliantssubrion
4.2.0
CNA
intelliantssubrion
4.2.1
CNA
Common Weakness Enumeration
References
https://github.com/volksec/SubrionCMS-Security-Advisories/issues/2
https://vuldb.com/cve/CVE-2026-96773
https://vuldb.com/submit/904805
https://vuldb.com/vuln/409028
https://vuldb.com/vuln/409028/cti