NodCMS has a vulnerable cross‑site request forgery flaw that allows an attacker to cause authenticated administrators to execute privileged actions via crafted forms. This flaw can lead to creation of new administrative users, alteration of system configuration, and potentially additional compromise of the application. The weakness is classified as CWE‑352 and is also related to CWE‑79.

The vulnerability affects all publicly documented nodCMS releases from version 1.0 through 3.4.1, as enumerated by the CPE identifiers in the advisory. Administrators of any of these installations are at risk if the application lacks CSRF protections on the affected admin endpoints.

The CVSS base score is 5.3, representing moderate severity, and the EPSS score is below 1%, indicating a low probability of active exploitation as of the latest data. The vulnerability is not listed in the CISA KEV catalogue. Exploitation requires a user with administrative privileges who has logged into the system; an attacker can entice such a user to submit a malicious form or embed a crafted request, thereby causing the target to perform privileged operations without their knowledge. The attack vector is likely through web‑based phishing or socially engineered content that leverages the trusted session of the administrator.