CVE-2021-26598: Impresscms

Medium severity, CVSS 5.3. EPSS: 10.5% chance of exploitation in the next 30 days.

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).

Affected products

• Impresscms Impresscms: before 1.4.3 (fixed in 1.4.3)

Published 2022-03-28. Last modified 2026-06-17.