CVE-2026-33384
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This enables an attacker to fix a session ID for a victim and later hijack the authenticated session.
Risk Assessment
An attacker can hijack an authenticated user's session, gaining unauthorized access to their account and data.
Recommendation
Apply the patch to version 6.8 published on 15.05.2026 or update QuickCMS to a newer version that includes the fix.
Other vulnerabilities in QuickCMS
See all- CVE-2026-33386Low
QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin-fetching mechanism. An attacker can perform a Man-in-the-Middle (MITM) attack by impersonating the opensolution.org server and serving arbitrary HTML or JavaScript at the plugin list endpoint. The issue was fixed in a patch to version 6.8 published on 15.05.2026.
- CVE-2026-1468Medium
QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft a special website that, when visited by the victim, automatically sends a POST request with the victim's privileges. No protection is implemented. Fixed in version 6.8 (14.05.2026).
Original NVD description (English source)
QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. This issue was fixed in a patch to version 6.8 published on 15.05.2026, deployments without this patch are still vulnerable.