CVE-2026-1468

CVE-2026-1468 is a Cross-Site Request Forgery (CSRF) vulnerability in QuickCMS version 6.8 [2]. The application lacks any CSRF protection mechanisms, making all forms potentially exploitable [1].

An attacker can craft a malicious website that, when visited by an authenticated administrator, automatically sends a POST request to the QuickCMS server. For example, it can create a new product with attacker-defined content without the administrator's consent [1]. No authentication bypass is needed as the attacker leverages the victim's existing session.

Successful exploitation allows an attacker to perform any action available through the application's forms, such as creating, modifying, or deleting content, with the privileges of the victim administrator [1]. This could lead to unauthorized changes to the website's content or configuration.

The vendor was notified but did not provide details on vulnerable version range or a patch. Only version 6.8 was confirmed vulnerable; other versions may also be affected [1]. Users are advised to consider implementing CSRF tokens or other protections, or to restrict access to the admin interface.