CVE-2026-67351

This vulnerability in Serendipity CMS allows an authenticated Editor to escalate to Administrator through a username collision during account creation. The technical mechanism: password validation and session loading operate as separate functions without a shared principal object. An Editor can create a new account with a username matching an existing Administrator account, and due to the independent session loading logic, the attacker gains the Administrator's session context—complete with theme and plugin editing capabilities that translate to arbitrary PHP execution. The CVSS 8.8 reflects the impact correctly, but the 0.0037 EPSS score is misleading rather than informative. This isn't because the vulnerability is unlikely to be exploited—it's because our exploitation detection infrastructure cannot see authenticated attack paths. Honeypots and scanners simulate unauthenticated external attackers; they don't simulate Editor-level authenticated sessions with user creation privileges. Your vulnerability scanners are blind to this entire class of flaws, which means EPSS underweights post-authentication logical vulnerabilities systematically, not incidentally. What you should do: First, audit your Serendipity deployments for version 2.6.1 and earlier—this vulnerability was patched in that release. Second, audit Editor-level accounts themselves. The exploitation vector requires an Editor account, and in many abandoned or neglected CMS installations, Editor accounts exist for former employees, contractors, or temporary staff who left years ago. The 'authenticated' prerequisite is often cheaper to obtain than defenders assume. Third, recognize that Administrator access in Serendipity is a gateway to RCE: theme editing and plugin installation both allow arbitrary PHP execution. An exploit of this vulnerability is not just privilege escalation—it is immediately exploitable code execution. For prioritization: treat CVSS 8.8 with authenticated access requirements as you would any critical vulnerability in your CMS. The EPSS signal here reflects a tooling gap, not a risk gap. If you run Serendipity, patch it. If you've deprecated Serendipity instances, decommission them—if you're not applying security patches to a CMS, the attack surface includes every authenticated account, known and forgotten.

Reviewed through automated stages and approved by a human before publication.