CVE-2018-3783: Privilege Escalation due to Blind NoSQL Injection in flintcms
Summary
CVE-2018-3783: Privilege Escalation due to Blind NoSQL Injection in flintcms. Affects flintcms versions < 1.1.10. Fixed in 1.1.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
FlintCMS is an npm package that provides a content management system (CMS) for building websites and web applications. It allows users to create and manage content, including user accounts and authentication. However, versions of FlintCMS prior to 1.1.10 are vulnerable to a blind NoSQL injection vulnerability in the password reset functionality.
Vulnerability Detail
The vulnerability in FlintCMS allows an attacker to perform a blind NoSQL injection attack during the password reset process. By exploiting this vulnerability, an attacker can bypass authentication and gain unauthorized access to user accounts. This can lead to privilege escalation, allowing the attacker to perform actions on behalf of legitimate users, potentially compromising the entire system. The vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
Latest published version: 1.1.11 as of 22 Oct 2026
npm install flintcms@1.1.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.10
This is the first release that contains the fix.
npm install flintcms@1.1.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
FlintCMS versions prior to 1.1.10 are vulnerable to a critical blind NoSQL injection vulnerability in the password reset functionality. To protect your system and prevent unauthorized access to user accounts, it is essential to update FlintCMS to version 1.1.10 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for flintcms →
FAQ
FlintCMS is an npm package that provides a content management system (CMS) for building websites and web applications. It allows users to create and manage content, including user accounts and authentication.
Blind NoSQL injection is a type of injection attack where an attacker can manipulate the input to a NoSQL database query in a way that allows them to extract information or perform unauthorized actions. In this case, the blind NoSQL injection vulnerability in FlintCMS allows an attacker to bypass authentication and gain unauthorized access to user accounts.
The consequences of this vulnerability include account takeover, privilege escalation, and unauthorized access to user accounts. An attacker who successfully exploits this vulnerability can perform actions on behalf of legitimate users, potentially compromising the entire system.
To protect your FlintCMS installation from this vulnerability, it is crucial to update to version 1.1.10 or later. This update includes a patch that addresses the blind NoSQL injection vulnerability in the password reset functionality.
No, there is no known workaround for this vulnerability. It is recommended to update FlintCMS to the latest version to mitigate the risk.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
