Medium severity · published Sep 20, 2026
CVE-2026-93961
Dromara UJCMS UserController UserController.java usernameExist improper authorization
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the component UserController. Performing a manipulation of the argument Username results in improper authorization. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UJ
UJCMS · Dromara
12.3.0; 12.3.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93961
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93961
github.com
https://github.com/dromara/ujcms/
github.com
https://github.com/dromara/ujcms/issues/22
vuldb.com
https://vuldb.com/cve/CVE-2026-93961
vuldb.com
https://vuldb.com/submit/944238
vuldb.com
https://vuldb.com/vuln/407920
vuldb.com
https://vuldb.com/vuln/407920/cti
More from UJCMS
9.8
CVE-2026-2954
Dromara UJCMS ImportDataController import-channel importChanel injection
9.8
CVE-2023-51350
A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script to the X-Forwarded-For function in the…
9.8
CVE-2023-34865
Directory traversal vulnerability in ujcms 6.0.2 allows attackers to move files via the rename feature
9.8
CVE-2023-34747
File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload
9.1
CVE-2026-2953
Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal