CVE-2026-4609: Unauthorized Access in ProfileGrid

The primary impact of CVE-2026-4609 is the potential for unauthorized access to closed and paid groups within ProfileGrid. An attacker, already logged in with a Subscriber account or higher, can leverage this vulnerability to add themselves or other registered users to these groups. This bypasses all authorization and payment mechanisms, granting access to content and features that should be restricted. This could lead to data breaches, exposure of sensitive information, and disruption of paid services. The ability to add arbitrary users to groups also opens the door for further malicious activity within those groups, such as spamming or phishing campaigns.

1. 已保留2026-03-23
2. 发布日期2026-05-12
3. 修改日期2026-05-13

The recommended mitigation for CVE-2026-4609 is to immediately upgrade ProfileGrid to version 5.9.8.5 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting group membership management to administrators only. Review user roles and permissions within ProfileGrid to ensure that only authorized personnel have the ability to manage group memberships. While a direct WAF rule is difficult to implement, monitor ProfileGrid logs for suspicious activity related to group membership changes and user additions.