---
id: CVE-2026-120185
title: ken678 YznCMS Auth Group Group.php Backend privileges management
summary: >-
  A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected
  element is the function Backend of the file
  app/admin/controller/auth/Group.php of the component Auth Group Handler.
  Performing a manipulation results in impr…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-269
  - CWE-266
vendor: ken678
product: YznCMS
affected:
  - YznCMS 2.0
  - YznCMS 2.1
  - YznCMS 2.2.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T14:38:42.410773Z'
published: '2026-10-31'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T14:39:02.110Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120185'
references:
  - url: 'https://vuldb.com/vuln/429502'
    label: >-
      VDB-429502 | ken678 YznCMS Auth Group Group.php Backend privileges
      management
  - url: 'https://vuldb.com/vuln/429502/cti'
    label: 'VDB-429502 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-120185'
    label: CVE-2026-120185 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1026603'
    label: 'Submit #1026603 | YZNCMS YznCMS 2.1.5 Privilege Escalation'
  - url: 'https://gitee.com/ken678/YZNCMS/commit/ed16cd7f7f73e0316ffa8a148d'
  - url: 'https://gitee.com/ken678/YZNCMS/tree/v2.2.1'
  - url: 'https://gitee.com/ken678/YZNCMS/'
tags:
  - cve.org
epss: 0.00227
epssPercentile: 0.13537
ingestedAt: '2026-11-05T19:30:42.668Z'
---

## Overview

A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated remotely. Upgrading to version 2.2.1 is sufficient to fix this issue. The patch is named ed16cd7f7f73e0316ffa8a148d. You should upgrade the affected component.

## Affected

- `YznCMS 2.0`
- `YznCMS 2.1`
- `YznCMS 2.2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.