CVE-2026-96773

Overview

Intelliants Subrion CMS up to 4.2.1 contains an open redirect flaw in the login page that can be triggered by manipulating the HTTP_REFERER header. The vulnerability allows attackers to redirect legitimate users to malicious sites without authentication. It can be exploited remotely and is publicly available.

Description

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $_SERVER['HTTP_REFERER'] causes open redirect. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

Confidentiality: minimal; Integrity: minimal; Availability: minimal. The flaw enables attackers to redirect users to phishing or malware sites, potentially compromising credentials or delivering malicious payloads. Defenders should monitor for suspicious redirects and educate users.

Remediation

Apply the vendor patch that validates or sanitizes the HTTP_REFERER header in front/login.php. If no patch is available, disable or remove the Login Page component, or configure the web server to reject or strip the HTTP_REFERER header. Additionally, implement a whitelist of allowed redirect URLs.

Risk context

Medium severity (CVSS 4.3/5.3) and low EPSS (0.0025) indicate moderate risk but still warrant prompt mitigation to prevent phishing attacks.

Affected products

• Intelliants Subrion CMS 4.2.1