CVE-2026-48199

Summary

The Sermon'e plugin has a broken access control vulnerability that allows unauthenticated users to access restricted administrative functions, potentially leading to unauthorized data exposure or modification.

Exploitability

Exploitation is straightforward with no prerequisites, as attackers can directly access protected endpoints without authentication.

Blast radius

The impact could be significant if attackers exploit this to gain access to sensitive sermon data, user information, or administrative controls, potentially affecting multiple users and content management.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.0.3 or later to address the broken access control issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.