PUBLISHED
2026-07-22 21:18
MODIFIED
2026-07-22 21:18
EPSS (Prob. Exploit)
0.20%
Top 90.7%
> DESCRIPTION
Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and items.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-284: Improper Access Control - The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. | CWE-352: Cross-Site Request Forgery - The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
> HISTORIQUE DES MODIFICATIONS
Première apparition
22/07/2026 21:18
Source: NVD
📊
ENRICHISSEMENT
01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-284: Improper Access Control - The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. | CWE-352: Cross-Site Request Forgery (CSRF) - The web applic...
Nouvelle valeur:
CWE-284: Improper Access Control - The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. | CWE-352: Cross-Site Request Forgery - The web application d...
📊
ENRICHISSEMENT
01/08/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-284: Improper Access Control - The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. | CWE-352: Cross-Site Request Forgery (CSRF) - The web applic...
Total des modifications: 2
Dernière mise à jour: 5 days ago