CVE-2016-9286: framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly rest...

Security readout for executives and security teams

This CVE describes an access-control flaw in Exponent CMS 2.4.0patch1 that could let a remote attacker view user address information without proper authorization. The business impact is privacy exposure, not system takeover based on the supplied sources. Severity scoring is not provided, and there is no cited evidence of active exploitation. Exposure is likely limited to organizations running Exponent CMS v2.4.0patch1 with user address records stored in the application. The provided affected-product metadata is incomplete, so version confirmation should come from local asset inventory and vendor release history. Prioritize if Exponent CMS is internet-facing or stores customer, employee, or member addresses. The likely impact is sensitive personal data disclosure, and evidence is insufficient to justify emergency treatment without confirmed exposure. Mitigation focus: Identify any Exponent CMS deployments and confirm their exact version.; Review the upstream commit and vendor guidance for the intended fix.; Upgrade to a vendor-supported fixed release if one is documented..

Prepared

Jun 13, 2026, 13:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.