CVE-2025-6736: JuzaWeb CMS 3.4.2 Vulnerable to Improper Authorization in Theme Installation
Summary
CVE-2025-6736: JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing certain components. Affects juzaweb/cms versions < 3.4.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
JuzaWeb CMS is an open-source content management system designed for building and managing websites. It offers a range of features including theme customization, plugin support, and user management. However, version 3.4.2 has been identified with a critical vulnerability that allows improper authorization during the installation of new themes, potentially compromising the security of the application.
Vulnerability Detail
The vulnerability arises from an improper authorization mechanism in the Add New Themes Page located at /admin-cp/theme/install. This flaw allows attackers to exploit the system remotely, leading to unauthorized access and manipulation of the CMS. The issue was disclosed publicly, and the vendor did not respond to the initial report, increasing the risk of exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the /admin-cp/theme/install page by implementing additional authentication checks or by disabling the theme installation feature until the patch is applied.
Conclusion
The vulnerability CVE-2025-6736 in JuzaWeb CMS 3.4.2 poses a significant security risk due to improper authorization during theme installation. It is crucial for users to update their installations to the latest version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for juzaweb/cms →
FAQ
CVE-2025-6736 is a vulnerability in JuzaWeb CMS 3.4.2 that allows improper authorization during theme installation.
If you are using JuzaWeb CMS version 3.4.2 or earlier, your installation is affected by this vulnerability.
The vulnerability can lead to unauthorized access and manipulation of the CMS, potentially compromising sensitive data and site integrity.
Yes, updating to the latest version of JuzaWeb CMS will resolve this vulnerability.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the composer.lock file. You can also check for vulnerabilities using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for juzaweb/cms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
