CVE-2026-28281

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28281", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-26T01:52:58.734Z", "datePublished": "2026-03-09T22:13:24.662Z", "dateUpdated": "2026-03-10T14:33:49.843Z"}, "containers": {"cna": {"title": "InstantCMS has Multiple CSRF Vulnerabilities", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/instantsoft/icms2/security/advisories/GHSA-pp43-262q-h73m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/instantsoft/icms2/security/advisories/GHSA-pp43-262q-h73m"}], "affected": [{"vendor": "instantsoft", "product": "icms2", "versions": [{"version": "< 2.18.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T22:13:24.662Z"}, "descriptions": [{"lang": "en", "value": "InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1."}], "source": {"advisory": "GHSA-pp43-262q-h73m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T14:33:44.185664Z", "id": "CVE-2026-28281", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:33:49.843Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28281", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T14:33:44.185664Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:33:47.178Z"}}], "cna": {"title": "InstantCMS has Multiple CSRF Vulnerabilities", "source": {"advisory": "GHSA-pp43-262q-h73m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "instantsoft", "product": "icms2", "versions": [{"status": "affected", "version": "< 2.18.1"}]}], "references": [{"url": "https://github.com/instantsoft/icms2/security/advisories/GHSA-pp43-262q-h73m", "name": "https://github.com/instantsoft/icms2/security/advisories/GHSA-pp43-262q-h73m", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T22:13:24.662Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28281", "state": "PUBLISHED", "dateUpdated": "2026-03-10T14:33:49.843Z", "dateReserved": "2026-02-26T01:52:58.734Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-09T22:13:24.662Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "icms2", "vendor": "instantsoft", "versions": [{"status": "affected", "version": "< 2.18.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:instantcms:instantcms:*:*:*:*:*:*:*:*", "matchCriteriaId": "941170FC-010F-46A8-9479-0D66316AF116", "versionEndExcluding": "2.18.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1."}, {"lang": "es", "value": "InstantCMS es un sistema de gesti\u00f3n de contenido gratuito y de c\u00f3digo abierto. Antes de la versi\u00f3n 2.18.1, InstantCMS no valida los tokens CSRF, lo que permite a los atacantes otorgar privilegios de moderador a los usuarios, ejecutar tareas programadas, mover publicaciones a la papelera y aceptar solicitudes de amistad en nombre del usuario. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.18.1."}], "id": "CVE-2026-28281", "lastModified": "2026-06-17T10:28:25.497", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28281", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T14:33:44.185664Z", "version": "2.0.3"}}]}, "published": "2026-03-10T17:38:39.103", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/instantsoft/icms2/security/advisories/GHSA-pp43-262q-h73m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.18.1)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "icms2", "source": "cna", "vendor": "instantsoft"}, "product": "icms2", "vendor": "instantcms"}], "analysis": {"en": {"generated_at": "2026-04-16T10:04:42.615640+00:00", "value": {"mitigation_remediation": ["Upgrade InstantCMS to version 2.18.1 or later, which includes CSRF token validation.", "Verify that CSRF protection is enabled for all forms and that proper token validation is implemented in the updated code.", "Restrict moderator creation to authenticated administrators and enforce least\u2011privilege policies to limit the impact of any future privilege\u2011escalation attempts."], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation via CSRF"}, "threat_synthesis": {"affected_systems": "InstantCMS versions prior to 2.18.1 distributed by instantsoft:icms2 are affected. The issue exists in all 2.x releases before the 2.18.1 patch, including older stable releases.", "description_and_impact": "The vulnerability is a cross\u2011site request forgery flaw that arises because InstantCMS does not validate CSRF tokens on several privileged actions. A malicious site can trick a logged\u2011in user into performing actions such as granting moderator rights, executing scheduled tasks, trashing posts, or accepting friend requests, thereby elevating the attacker\u2019s privileges without changing the user\u2019s password.", "risk_and_exploitability": "The vulnerability has a CVSS base score of 7.1, indicating moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first obtain a victim session, then craft a forged request; CSRF is the inferred attack vector, as the flaw is linked to missing token validation on user\u2011controlled actions."}}}}, "created": "2026-03-10T14:06:40.049613+00:00", "updated": "2026-04-16T10:15:26.105124+00:00", "vendors": ["instantcms", "instantcms$PRODUCT$icms2"]}