CVE-2026-1468

Cross-Site Request Forgery in QuickCMS

Published Mar 6, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Description

QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges.
This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable.

This issue was fixed in a patch to version 6.8 published on 14.05.2026, deployments without this patch are still vulnerable

Analysis

Technical impact

QuickCMS lacks CSRF protection across multiple endpoints, meaning every form could be exploited. This vulnerability, a classic Cross‑Site Request Forgery (CWE‑352), allows an attacker to craft a malicious web page that, when visited by a logged‑in user, automatically sends a POST request using the victim’s credentials. This flaw allows the attacker to perform any state‑changing operation the victim is authorized to execute, such as editing or deleting content.

Affected Systems

OpenSolution QuickCMS is affected. Versions prior to 6.8 are vulnerable; 6.8 contains a fix.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.1, indicating moderate impact. The EPSS score is below 1 %, indicating a low current likelihood of exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is a social engineering or phishing scenario where the victim visits a malicious site while logged into the CMS; this inference is based on the description of the payload being automatically sent with the victim’s privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OpenSolution

QuickCMS

unaffected

Version	Status	Constraints
`0`	affected	≤ 6.8

No data.

Vendor Product Versions

Opensolution

Quick.cms

Version	Status	Scheme	Platform
`6.8`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Check for and apply any QuickCMS update that addresses CSRF weaknesses when available.
Deploy server‑side CSRF tokens on all dynamic forms and validate them for every state‑changing request.
Configure a web application firewall to block or rate‑limit POST requests that do not contain a valid CSRF token or originate from unexpected referrers.

Generated by OpenCVE AI on August 5, 2026 at 03:53 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.231% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cert.pl/posts/2026/03/CVE-2026-1468
https://opensolution.org/cms-system-quick-cms.html

History

Aug 4, 2026 12:45 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
Description	QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges. This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.	QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges. This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable. This issue was fixed in a patch to version 6.8 published on 14.05.2026, deployments without this patch are still vulnerable
First Time appeared		Opensolution quickcms
CPEs		cpe:2.3:a:opensolution:quickcms::::::::
Vendors & Products		Opensolution quickcms

Mar 9, 2026 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 9, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Opensolution Opensolution quick.cms
Vendors & Products		Opensolution Opensolution quick.cms

Mar 6, 2026 11:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges. This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Title		Cross-Site Request Forgery in QuickCMS
Weaknesses		CWE-352
References		https://cert.pl/posts/2026/03/CVE-2026-1468 https://opensolution.org/cms-system-quick-cms.html
Metrics		cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}`