Fiyo CMS version 2.0.6.1 suffers from a privilege escalation vulnerability due to poor design with trusting the client to tell the server a user’s role.