Feehi CMS REST API /api/articles Missing Authentication

#!/usr/bin/env bash
# CVE-2026-13546 Checker — Feehi CMS /api/articles Missing Authentication
# Usage: bash check_cve_2026_13546.sh <base_url>
# Example: bash check_cve_2026_13546.sh https://cms.example.com
# Exit codes: 0 = VULNERABLE, 1 = PATCHED, 2 = UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <base_url>"
  echo "Example: $0 https://cms.example.com"
  exit 2
fi

BASE_URL="${1%/}"
ENDPOINT="${BASE_URL}/api/articles"

echo "[*] CVE-2026-13546 — Feehi CMS Missing Auth Check"
echo "[*] Target: ${ENDPOINT}"
echo ""

# Send unauthenticated GET to /api/articles
HTTP_CODE=$(curl -s -o /tmp/cve_2026_13546_response.json -w "%{http_code}" \
  -X GET "${ENDPOINT}" \
  -H "Accept: application/json" \
  --connect-timeout 10 \
  --max-time 15 2>/dev/null || echo "000")

if [ "${HTTP_CODE}" = "000" ]; then
  echo "[!] UNKNOWN — Could not connect to ${ENDPOINT}"
  rm -f /tmp/cve_2026_13546_response.json
  exit 2
fi

echo "[*] HTTP response code: ${HTTP_CODE}"

if [ "${HTTP_CODE}" = "200" ]; then
  # Check if response contains article data (JSON array or object with article fields)
  if grep -qiE '"id".*"title"|"content"|"created_at"' /tmp/cve_2026_13546_response.json 2>/dev/null; then
    echo "[!] VULNERABLE — /api/articles returned article data without authentication"
    echo "[*] Response preview (first 300 chars):"
    head -c 300 /tmp/cve_2026_13546_response.json
    echo ""
    rm -f /tmp/cve_2026_13546_response.json
    exit 0
  else
    echo "[?] UNKNOWN — Got HTTP 200 but response does not look like article data"
    rm -f /tmp/cve_2026_13546_response.json
    exit 2
  fi
elif [ "${HTTP_CODE}" = "401" ] || [ "${HTTP_CODE}" = "403" ]; then
  echo "[+] PATCHED — /api/articles requires authentication (HTTP ${HTTP_CODE})"
  rm -f /tmp/cve_2026_13546_response.json
  exit 1
elif [ "${HTTP_CODE}" = "404" ]; then
  echo "[+] PATCHED — /api/articles endpoint not found (HTTP 404); API may be disabled or not Feehi CMS"
  rm -f /tmp/cve_2026_13546_response.json
  exit 1
else
  echo "[?] UNKNOWN — Unexpected HTTP response code: ${HTTP_CODE}"
  rm -f /tmp/cve_2026_13546_response.json
  exit 2
fi