Unrated severityNVD Advisory· Published Jun 17, 2026· Updated Jun 17, 2026

Cross-Site Request Forgery (CSRF) in SimplCommerce News Module

CVE-2026-9591

Description

Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to /api/news-items, due to missing anti-CSRF protection.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Simplcommerce/Simplcommercellm-fuzzy
Range: < 6233d73e

Patches

Vulnerability mechanics

References

github.com/simplcommerce/SimplCommerce/commit/6233d73e134c887fc3f3308d20710bec096d45e3mitrepatch
github.com/simplcommerce/SimplCommerce/pull/1150mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000