CVE-2026-1468
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft a special website that, when visited by the victim, automatically sends a POST request with the victim's privileges. No protection is implemented. Fixed in version 6.8 (14.05.2026).
Risk Assessment
An attacker can perform unauthorized actions on behalf of a logged-in user, such as changing settings or deleting data.
Recommendation
Update QuickCMS to version 6.8 or later that includes the fix.
Other vulnerabilities in QuickCMS
See all- CVE-2026-33386Low
QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin-fetching mechanism. An attacker can perform a Man-in-the-Middle (MITM) attack by impersonating the opensolution.org server and serving arbitrary HTML or JavaScript at the plugin list endpoint. The issue was fixed in a patch to version 6.8 published on 15.05.2026.
- CVE-2026-33384Medium
QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This enables an attacker to fix a session ID for a victim and later hijack the authenticated session.
Original NVD description (English source)
QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges. This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable. This issue was fixed in a patch to version 6.8 published on 14.05.2026, deployments without this patch are still vulnerable