{"id":"CVE-2020-36890","title":"An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests","summary":"An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalida…","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-862"],"vendor":"kentico","product":"xperience","affected":["xperience <= 12.0.60"],"published":"2025-12-18","updated":"2026-08-10","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-36890","references":[{"url":"https://devnet.kentico.com/download/hotfixes","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/kentico-xperience-administrator-access-control-bypass","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00343,"epssPercentile":0.27951,"ingestedAt":"2026-08-11T16:47:03.797Z","slug":"CVE-2020-36890","body":"## Overview\n\nAn access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalidate security-sensitive macros by manipulating user privilege levels.\n\n## Affected\n\n- `xperience <= 12.0.60`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}