CVE-2026-13546: Authentication Bypass in Feehi CMS /api/articles REST API

Technical summary

The vulnerability stems from missing or improperly implemented authentication checks in the /api/articles REST API endpoint. This is a classic authentication bypass scenario where the API fails to verify user identity before processing requests. The flaw affects the Feehi CMS application up through version 2.1.1 and permits unauthenticated remote manipulation of article resources. The weakness maps to CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function), indicating the API endpoint lacks proper identity verification mechanisms before allowing sensitive operations.

Business impact

Organizations running Feehi CMS are exposed to unauthorized access to article management functions. Attackers can read, modify, or delete published content without authentication, potentially leading to defacement, data exfiltration, or disruption of publishing workflows. For CMS deployments supporting customer-facing websites or internal knowledge bases, this could result in loss of data integrity, reputational damage, and business continuity interruptions. The public availability of exploit information amplifies risk significantly.

Affected systems

Feehi CMS versions up to and including 2.1.1 are affected. Organizations should audit their deployments to confirm the running version. The REST API endpoint /api/articles is the primary attack vector. Any instance accessible via network connectivity—whether publicly internet-facing or within internal networks—is potentially exploitable.

Exploitability

Exploitability is high. The attack requires no authentication, no special user interaction, and no complex configuration; it can be initiated remotely over the network. A low-complexity payload targeting the /api/articles endpoint can demonstrate the flaw. Public disclosure of the vulnerability means proof-of-concept tooling or exploitation techniques may already be circulating in security communities, though no official entry in the Known Exploited Vulnerabilities (KEV) catalog has been recorded yet.

Remediation

Upgrade Feehi CMS to a patched version released by the project after version 2.1.1. The project has been notified of the issue but has not yet responded publicly with a fixed release. Until an official patch is available, implement network-level access controls to restrict direct client connections to the /api/articles endpoint, or disable the REST API if not essential to operations. Review and strengthen API authentication policies across all custom or third-party integrations.

Patch guidance

Contact Feehi CMS maintainers or monitor their official release channels for a security update addressing CVE-2026-13546. Verify the patched version number against vendor advisories before deployment. In parallel, implement compensating controls: place API endpoints behind an API gateway or reverse proxy that enforces authentication, rate-limit requests to the /api/articles path, and require TLS encryption for all API traffic. Once a patch is released, prioritize testing and deployment to minimize the window of exposure.

Detection guidance

Monitor logs for unauthenticated requests to /api/articles or related article management endpoints. Look for unusual patterns: requests without valid session tokens or API keys, repeated GET/POST/PUT/DELETE operations from unexpected sources, or spikes in API traffic from external IP ranges. Implement Web Application Firewall (WAF) rules to flag or block requests to /api/articles that lack proper Authorization headers. Enable detailed logging of all REST API access, including request source, method, parameters, and response status. Search historical logs for evidence of unauthorized access during the vulnerability window.

Why prioritize this

This vulnerability merits immediate attention due to the combination of high CVSS score (7.3), public exploit availability, and complete lack of authentication requirements. The authentication bypass directly exposes business-critical content management functions to remote attackers. Organizations should treat this as a high-priority remediation target, especially if their Feehi CMS instances are internet-exposed or handle sensitive organizational data.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects multiple risk factors: Network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and no user interaction needed (UI:N). The vulnerability impacts confidentiality, integrity, and availability of article resources (C:L/I:L/A:L). While the scope is unchanged (S:U), the absence of authentication controls and the public nature of the exploit elevate real-world exploitation risk substantially above the base score alone.

Frequently asked questions