PT-2026-50426 · Simplcommerce · Simplcommerce

Publicado 2026-06-17 · Atualizado 2026-06-17 · CVE-2026-9591

Mitre

CVSS v4.0

8.3

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to /api/news-items, due to missing anti-CSRF protection.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-9591

Produtos afetados

Simplcommerce

Referências · 2

• https://github.com/simplcommerce/SimplCommerce/commit/6233d73e134c887fc3f3308d20710bec096d45e3 · Correção
• https://github.com/simplcommerce/SimplCommerce/pull/1150 · Nota