CVE-2020-36890

An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalidate security-sensitive macros by manipulating user privilege levels.

Score

CVSS 4.0 8.6 High

Status

Analyzed - disclosure@vulncheck.com

Published

2025-12-18

Last modified

2026-08-10

Weaknesses

CWE-862

Affected products

• Xperience (Kentico)

References

• https://devnet.kentico.com/download/hotfixes
• https://www.vulncheck.com/advisories/kentico-xperience-administrator-access-control-bypass