CVE-2026-1468

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1468", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-01-27T08:08:29.063Z", "datePublished": "2026-03-06T11:04:07.426Z", "dateUpdated": "2026-08-04T12:21:58.801Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-08-04T12:21:58.801Z"}, "title": "Cross-Site Request Forgery in QuickCMS", "datePublic": "2026-03-06T11:08:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "affected": [{"vendor": "OpenSolution", "product": "QuickCMS", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "6.8", "changes": [{"at": "patch published on 14.05.26", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:opensolution:quickcms:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "6.8"}]}]}], "descriptions": [{"lang": "en", "value": "QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges.\nThis software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable.\n\nThis issue was fixed in a patch to version 6.8 published on 14.05.2026, deployments without this patch are still vulnerable", "supportingMedia": [{"type": "text/html", "base64": false, "value": "QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges.<br>This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable.<br><br>This issue was fixed in a patch to version 6.8 published on 14.05.2026, deployments without this patch are still vulnerable"}]}], "references": [{"url": "https://cert.pl/posts/2026/03/CVE-2026-1468", "tags": ["third-party-advisory"]}, {"url": "https://opensolution.org/cms-system-quick-cms.html", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Micha\u0142 Biesiada", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1468", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T20:56:57.048346Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T21:04:31.809Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1468", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T20:56:57.048346Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:58:08.298Z"}}], "cna": {"title": "Cross-Site Request Forgery in QuickCMS", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Micha\u0142 Biesiada"}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenSolution", "product": "QuickCMS", "versions": [{"status": "affected", "changes": [{"at": "patch published on 14.05.26", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "6.8"}], "defaultStatus": "unaffected"}], "datePublic": "2026-03-06T11:08:00.000Z", "references": [{"url": "https://cert.pl/posts/2026/03/CVE-2026-1468", "tags": ["third-party-advisory"]}, {"url": "https://opensolution.org/cms-system-quick-cms.html", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges.\nThis software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable.\n\nThis issue was fixed in a patch to version 6.8 published on 14.05.2026, deployments without this patch are still vulnerable", "supportingMedia": [{"type": "text/html", "value": "QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges.<br>This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable.<br><br>This issue was fixed in a patch to version 6.8 published on 14.05.2026, deployments without this patch are still vulnerable", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opensolution:quickcms:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "6.8", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-08-04T12:21:58.801Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1468", "state": "PUBLISHED", "dateUpdated": "2026-08-04T12:21:58.801Z", "dateReserved": "2026-01-27T08:08:29.063Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-03-06T11:04:07.426Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "QuickCMS", "vendor": "OpenSolution", "versions": [{"changes": [{"at": "patch published on 14.05.26", "status": "unaffected"}], "lessThanOrEqual": "6.8", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges.\nThis software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable.\n\nThis issue was fixed in a patch to version 6.8 published on 14.05.2026, deployments without this patch are still vulnerable"}, {"lang": "es", "value": "QuickCMS es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en m\u00faltiples puntos finales. Un atacante puede crear un sitio web especial que, al ser visitado por la v\u00edctima, enviar\u00e1 autom\u00e1ticamente una petici\u00f3n POST con los privilegios de la v\u00edctima.\nEste software no implementa ninguna protecci\u00f3n contra este tipo de ataque. Todos los formularios disponibles en este software son potencialmente vulnerables.\n\nEl proveedor fue notificado con antelaci\u00f3n sobre esta vulnerabilidad, pero no respondi\u00f3 con los detalles de la vulnerabilidad o el rango de versiones vulnerables. Solo la versi\u00f3n 6.8 fue probada y confirmada como vulnerable; otras versiones no fueron probadas y tambi\u00e9n podr\u00edan ser vulnerables."}], "id": "CVE-2026-1468", "lastModified": "2026-08-04T13:17:36.800", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1468", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T20:56:57.048346Z", "version": "2.0.3"}}]}, "published": "2026-03-06T11:16:08.613", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/posts/2026/03/CVE-2026-1468"}, {"source": "cvd@cert.pl", "url": "https://opensolution.org/cms-system-quick-cms.html"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "QuickCMS", "source": "cna", "vendor": "OpenSolution"}, "product": "quick.cms", "vendor": "opensolution"}], "created": "2026-03-09T10:08:08.473111+00:00", "updated": "2026-08-05T04:00:06.481213+00:00", "vendors": ["opensolution", "opensolution$PRODUCT$quick.cms"]}