CVE-2017-9378

BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks such as data backups to complete before a user is deleted...

CVE-2017-9378

BigTree CMS up to version 4.2.18 allows a user to delete their own account, an action that should be admin-only. The root cause is a missing access-control check on account deletion, enabling self-removal and potential disruption to admin workflows (e.g., data backups). No exploits or in‑the‑wild...