CVE-2026-1141
Published: 19 January 2026
Summary
CVE-2026-1141 is a medium-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Phpgurukul News Portal. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 21.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-1141 is an improper authorization vulnerability affecting PHPGurukul News Portal 1.0. The issue resides in an unknown function within the file /admin/add-subadmins.php of the Add Sub-Admin Page component. Manipulation of this element leads to unauthorized actions, classified under CWE-266 and CWE-285, with a CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability enables remote exploitation by attackers possessing low privileges, such as a standard user account. Exploitation requires network access and low complexity but no user interaction. Successful attacks can result in limited impacts to confidentiality, integrity, and availability, potentially allowing partial unauthorized data access, modification, or disruption.
VulDB advisories (ctiid.341733, id.341733, submit.735483) detail the vulnerability, while a public proof-of-concept exploit is available on GitHub at https://github.com/Asim-QAZi/BrokenAccessControl-News-Portal-Project-in-PHP-and-MySQL-in-PHPGurukul. The vendor site at https://phpgurukul.com/ provides project context, but no patches or specific mitigations are referenced.
The public availability of the exploit heightens the risk of real-world exploitation against unpatched instances of PHPGurukul News Portal 1.0.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3237
Vulnerability details
A vulnerability was identified in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /admin/add-subadmins.php of the component Add Sub-Admin Page. Such manipulation leads to improper authorization. The attack can be launched remotely. The exploit…
more
is publicly available and might be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper authorization (broken access control) in a public-facing web app directly enables remote exploitation by low-privileged accounts to perform unauthorized admin actions, mapping to privilege escalation via vuln exploitation and public-facing app exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authorization checks on the add-subadmins.php function so that low-privileged accounts cannot perform the unauthorized sub-admin creation action.
Ensures standard user accounts are not granted the excessive privileges that would allow them to reach or manipulate the vulnerable Add Sub-Admin page.
Requires explicit account provisioning and privilege assignment processes that would prevent the incorrect privilege grants underlying this CWE-266 flaw.