Description
QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges.
This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable.

This issue was fixed in a patch to version 6.8 published on 14.05.2026, deployments without this patch are still vulnerable
Published: 2026-03-06
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

QuickCMS lacks CSRF protection across multiple endpoints, meaning every form could be exploited. This vulnerability, a classic Cross‑Site Request Forgery (CWE‑352), allows an attacker to craft a malicious web page that, when visited by a logged‑in user, automatically sends a POST request using the victim’s credentials. This flaw allows the attacker to perform any state‑changing operation the victim is authorized to execute, such as editing or deleting content.

Affected Systems

OpenSolution QuickCMS is affected. Versions prior to 6.8 are vulnerable; 6.8 contains a fix.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.1, indicating moderate impact. The EPSS score is below 1 %, indicating a low current likelihood of exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is a social engineering or phishing scenario where the victim visits a malicious site while logged into the CMS; this inference is based on the description of the payload being automatically sent with the victim’s privileges.

Generated by OpenCVE AI on August 5, 2026 at 03:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check for and apply any QuickCMS update that addresses CSRF weaknesses when available.
  • Deploy server‑side CSRF tokens on all dynamic forms and validate them for every state‑changing request.
  • Configure a web application firewall to block or rate‑limit POST requests that do not contain a valid CSRF token or originate from unexpected referrers.

Generated by OpenCVE AI on August 5, 2026 at 03:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges. This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges. This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable. This issue was fixed in a patch to version 6.8 published on 14.05.2026, deployments without this patch are still vulnerable
First Time appeared Opensolution quickcms
CPEs cpe:2.3:a:opensolution:quickcms:*:*:*:*:*:*:*:*
Vendors & Products Opensolution quickcms

Mon, 09 Mar 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 09 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Opensolution
Opensolution quick.cms
Vendors & Products Opensolution
Opensolution quick.cms

Fri, 06 Mar 2026 11:15:00 +0000

Type Values Removed Values Added
Description QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges. This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Title Cross-Site Request Forgery in QuickCMS
Weaknesses CWE-352
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Opensolution Quick.cms Quickcms
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-08-04T12:21:58.801Z

Reserved: 2026-01-27T08:08:29.063Z

Link: CVE-2026-1468

cve-icon Vulnrichment

Updated: 2026-03-09T20:58:08.298Z

cve-icon NVD

Status : Deferred

Published: 2026-03-06T11:16:08.613

Modified: 2026-08-04T13:17:36.800

Link: CVE-2026-1468

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T04:00:06Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)