CVE-2026-9591 - Cross-Site Request Forgery (CSRF) in SimplCommerce News Module

Back Back to CVE browser

MEDIUM

Cross-Site Request Forgery (CSRF) in SimplCommerce News Module

Published Jun 17, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.28%

Description

Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to `/api/news-items`, due to missing anti-CSRF protection.

Affected products

Vendor Simplcommerce Product SimplCommerce Default
affected
Affected
- ≥ 0, < 6233d73e

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Simplcommerce	SimplCommerce	affected	Affected ≥ 0, < 6233d73e

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-37710		Advisory
https://github.com/simplcommerce/SimplCommerce/commit/6233d73e134c887fc3f3308d20710bec096d45e3		patch
https://github.com/simplcommerce/SimplCommerce/pull/1150

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Checkmarx

Published Jun 17, 2026

Updated Jun 18, 2026

Reserved May 26, 2026

Link CVE-2026-9591

CISA Vulnrichment

Updated Jun 17, 2026

NVD

Status Deferred

Modified Jun 18, 2026

Link CVE-2026-9591

Red Hat

No data

ENISA EUVD

Assigner Checkmarx

Published Jun 17, 2026

Updated Jun 18, 2026

Link EUVD-2026-37710

GitHub

No data