CVE-2006-3935: system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to adm...

Security readout for executives and security teams

OpenCms versions before 6.2.2 allowed a logged-in user to reach administrator-only workplace functions directly. That could let a non-admin broadcast messages, create web users, upload database files or modules, and read logs. The issue matters most where old OpenCms systems still exist and ordinary authenticated accounts remain active. Likely exposure is limited to Alkacon OpenCms deployments older than 6.2.2 with authenticated non-admin users and reachable workplace/admin functionality. Current internet-wide exposure is unknown from the supplied sources. Prioritize remediation for any legacy OpenCms instance that is still reachable by users. The issue can cross an authorization boundary into administrative functions, including upload paths, but the supplied evidence does not confirm current active exploitation. Mitigation focus: Upgrade OpenCms to 6.2.2 or later where applicable.; Check current OpenCms vendor guidance for supported upgrade paths.; Restrict workplace/admin access to trusted administrators and trusted networks..

Prepared

Jun 29, 2026, 11:12 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.