CVE-2026-3786
Published: 08 March 2026
Summary
CVE-2026-3786 is a medium-severity Injection (CWE-74) vulnerability in Easycms Easycms. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-3786 is a SQL injection vulnerability affecting EasyCMS versions up to 1.6. The flaw resides in an unknown function within the file /RbacuserAction.class.php, part of the Request Parameter Handler component. By manipulating the _order argument, attackers can inject malicious SQL payloads, as classified under CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection). The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2026-03-08.
The attack is remotely exploitable over the network with low complexity and requires low privileges, such as an authenticated user account. Successful exploitation allows partial compromise of confidentiality, integrity, and availability, potentially enabling data exfiltration, modification, or disruption through injected SQL queries. A public exploit has been released, increasing the risk of real-world attacks.
Advisories from VulDB and a GitHub issue detail the vulnerability but note that the vendor was contacted early without any response or patch release. No official mitigations are available, leaving administrators to rely on input validation, web application firewalls, or restricting access to affected endpoints until a fix is provided.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10276
Vulnerability details
A security flaw has been discovered in EasyCMS up to 1.6. The impacted element is an unknown function of the file /RbacuserAction.class.php of the component Request Parameter Handler. The manipulation of the argument _order results in sql injection. The attack…
more
can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in publicly accessible EasyCMS web application component directly enables remote exploitation of a public-facing application (T1190) with low-privilege authenticated access, leading to limited data confidentiality/integrity/availability impacts via malicious SQL payloads.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted input parameters such as _order before they are used in SQL statements, blocking the injection vector at its source.
Boundary-protection mechanisms (e.g., WAF rules) can inspect and drop requests containing SQL metacharacters targeting /RbacuserAction.class.php before they reach the vulnerable handler.
Enforces access-control policy on the Request Parameter Handler component, limiting which authenticated users can reach the _order parameter and thereby reducing the attack surface.