CVE-2008-5846: Six Apart Movable Type (MT) before 4.23 allows remote authenticated users with create permission for posts...

Security readout for executives and security teams

CVE-2008-5846 is an access-control flaw in Six Apart Movable Type before 4.23. A logged-in user who can create posts could bypass intended restrictions and publish content through a system-wide entry listing screen. The main business risk is unauthorized public content, brand damage, and workflow bypass. Exposure is likely limited to organizations still running legacy Movable Type installations before 4.23 with authenticated users allowed to create posts. Public internet exposure is less important than whether untrusted or lower-privileged authors have CMS access. Prioritize remediation if Movable Type is still used for public-facing or regulated communications. The vulnerability is old and authenticated, but unauthorized publishing can create reputational, compliance, and incident-response costs. Mitigation focus: Upgrade Movable Type to 4.23 or later per vendor guidance.; Restrict post creation rights to trusted users until upgraded.; Review publishing workflows for unintended direct-publish paths..

Prepared

Jun 28, 2026, 11:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.