CVE-2026-97191

{
  "etk_id": "ETK-2026-3802",
  "cve_id": "CVE-2026-97191",
  "display_id": "CVE-2026-97191",
  "ghsa_id": "GHSA-32f3-wpx7-chp4",
  "euvd_id": "EUVD-2026-118957",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Advanced Custom Fields",
  "summary": "Advanced Custom Fields (ACF) versions before 6.8.11 do not consistently enforce field-group location restrictions when posts are saved through the WordPress editor. Contributors and other users able to save posts may add custom fields that were intended to be limited to administrators on their own posts.",
  "mitigation": "Upgrade Advanced Custom Fields to version 6.8.11 or later. Until upgraded, restrict untrusted users' ability to create or edit posts.",
  "vendor": null,
  "product": "Advanced Custom Fields (ACF®)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 6.8.11"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "6.8.11"
      ],
      "package_name": "Advanced Custom Fields (ACF®)",
      "purl": null
    }
  ],
  "cwes": [
    284
  ],
  "cvss_score": 2.7,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 20.951856166666666,
  "t0_at": "2026-11-07T06:00:24.463000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-07T07:33:34.557909+00:00",
      "days": 0.06470017255787038,
      "is_lower_bound": false,
      "measured_at": "2026-11-07T06:00:24.463000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-07T06:00:24.463000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-07T06:00:24.463000+00:00",
      "url": "https://github.com/advisories/GHSA-32f3-wpx7-chp4"
    }
  }
}