CVE-2026-67207

The CVE-2026-67207 vulnerability in Wolf CMS versions up to 0.8.3.1 stems from a PHP operator precedence error in BackupRestoreController that allows authenticated users without admin privileges to create, download, and restore backups. The flawed expression uses incorrect operator precedence that evaluates an authorization check incorrectly—specifically, it treats the permission check as a logical OR when it should be AND, allowing the backup operations to proceed when either authentication succeeds OR the role check evaluates falsely due to precedence. The practical impact is significant: an attacker with any valid user account can extract the entire database, configuration files (including potential secret keys), and potentially other user data through the backup restore chain. This transforms a standard user account into full system compromise. Two factors work in your favor: the EPSS score of 0.003 suggests the vulnerable code path isn't commonly reached in typical deployments, likely because backup functionality isn't frequently accessed. However, this should not inspire complacency—if your Wolf CMS deployment exposes backup functionality to authenticated users, the blast radius of a successful exploit is high. What to do: First, audit whether your Wolf CMS instance exposes the /backup_restore endpoint to non-admin users. Second, check user role configurations—ensure no roles with limited permissions have access to backup operations. Third, consider network-level restrictions on backup endpoints if they're not business-required. Fourth, evaluate migration: Wolf CMS 0.8.3.1 appears largely unmaintained, meaning upstream security patches may never arrive. If you're running this in production, treat the absence of a vendor patch as a forcing function for migration planning rather than waiting for one that may never come. The operator precedence pattern itself is worth tracking: PHP authentication bypasses stemming from precedence errors have recurred across multiple codebases and years. Treat this CVE as evidence that any permission check expression involving multiple operators warrants explicit parentheses regardless of correctness—cognitive traps in boolean logic are a recurring PHP vulnerability class.

Reviewed through automated stages and approved by a human before publication.