The vulnerability is a cross‑site request forgery flaw that arises because InstantCMS does not validate CSRF tokens on several privileged actions. A malicious site can trick a logged‑in user into performing actions such as granting moderator rights, executing scheduled tasks, trashing posts, or accepting friend requests, thereby elevating the attacker’s privileges without changing the user’s password.

InstantCMS versions prior to 2.18.1 distributed by instantsoft:icms2 are affected. The issue exists in all 2.x releases before the 2.18.1 patch, including older stable releases.

The vulnerability has a CVSS base score of 7.1, indicating moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first obtain a victim session, then craft a forged request; CSRF is the inferred attack vector, as the flaw is linked to missing token validation on user‑controlled actions.