Vulnerability details
CVE-2020-36890
Kentico Xperience
Kentico Xperience <= 10 Administrator Access Control Bypass
CVSS 4.0
8.6High
Official description
An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalidate security-sensitive macros by manipulating user privilege levels.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.6High | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 7.2High | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Kentico | Xperience | v ≤ 12.0.60 | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://devnet.kentico.com/download/hotfixes vendor-advisorypatch
- https://www.vulncheck.com/advisories/kentico-xperience-administrator-access-control-bypass third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-12-18
- Last updated
- 2026-08-10
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
0.34%
Probability of exploitation in 30 days
28%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-862Missing Authorization