Security readout for executives and security teams
Plain-English summary
CVE-2026-1141 affects PHPGurukul News Portal 1.0. An authenticated remote user may improperly access the Add Sub-Admin function, potentially changing administrative privileges. Public proof-of-concept material is referenced, but CISA KEV is not listed and the provided sources do not confirm active exploitation.
Executive priority
Prioritize if PHPGurukul News Portal 1.0 is internet-facing or used for operational publishing. The issue is not marked as actively exploited, but public exploit availability and privilege-management impact justify timely containment and review.
Technical view
The issue is improper authorization in /admin/add-subadmins.php, associated with the Add Sub-Admin Page. VulDB maps it to CWE-266 and CWE-285 with CVSS 2.0 score 6.5. The vector indicates network access, low complexity, and required authentication, with partial confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to organizations running PHPGurukul News Portal 1.0, especially if the admin interface is reachable by untrusted users. The CVSS vector indicates authentication is required, reducing drive-by risk but still creating insider or compromised-account risk.
Exploitation context
VulDB states the attack can be launched remotely and that exploit material is publicly available. The provided bundle does not show KEV listing or verified active exploitation. Treat public-facing or broadly accessible admin panels as higher priority.
Researcher notes
Evidence comes primarily from VulDB and CVE records. The affected function is unspecified beyond /admin/add-subadmins.php. No vendor patch, fixed version, or official mitigation is identified in the provided sources, so remediation should be guided by vendor updates and local authorization review.
Mitigation direction
- Check PHPGurukul and VulDB for vendor guidance or fixed releases.
- Restrict access to the News Portal admin area to trusted networks or VPN.
- Review authorization checks around /admin/add-subadmins.php before allowing production use.
- Audit existing sub-admin accounts for unauthorized or unexpected additions.
- Apply compensating access controls if no vendor patch is available.
Validation and detection
- Inventory PHPGurukul News Portal deployments and confirm whether version 1.0 is present.
- Identify whether /admin/add-subadmins.php exists in deployed code.
- Confirm admin pages require appropriate role checks, not just authentication.
- Review logs for unexpected sub-admin creation or access to the Add Sub-Admin page.
- Verify administrative interfaces are not exposed to the public internet.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-266: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-285: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1141 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR86.4Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
6.5MediumVector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
Source materials
- CVE List V5 sourceCVE List V5
- VDB-341733 | PHPGurukul News Portal Add Sub-Admin add-subadmins.php improper authorizationCVE reference · vdb-entry, technical-description
- VDB-341733 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #735483 | PHPGurukul News Portal Project in PHP and MySql 1.0 Improper Access ControlsCVE reference · third-party-advisory
- Submit #736668 | PHPGurukul News Portal v1.0 Authorization Bypass (Duplicate)CVE reference · third-party-advisory
- https://github.com/Asim-QAZi/BrokenAccessControl-News-Portal-Project-in-PHP-and-MySQL-in-PHPGurukulCVE reference · exploit
- https://phpgurukul.com/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Privilege Assignment
Incorrect Privilege Assignment represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Authorization
Improper Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.