CVE-2026-39170

Vulnerability

SEMCMS versions 5.0 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability within the administrative user management module. The application fails to implement anti-CSRF token validation for user management operations, making it susceptible to malicious requests [1].

Exploitation

An attacker can exploit this vulnerability by tricking an authenticated administrator into executing unintended actions via a crafted malicious request. This is achieved by leveraging the lack of anti-CSRF token validation in the user management module, specifically targeting POST requests to /admin/semcms_user.php [1].

Impact

Successful exploitation allows an attacker to perform unintended actions on behalf of an authenticated administrator. This could lead to unauthorized modifications or deletions of user data, or other administrative actions that the administrator might not intend to perform, due to the CSRF vulnerability [1].

Mitigation

SEMCMS versions 5.0 and earlier are affected. Information regarding a fixed version or specific mitigation steps beyond preventing user interaction with malicious requests is not yet disclosed in the available references [1].