CVE-2026-39170: SemCms 5.0 CSRF Vulnerability in Admin User Management

Technical summary

The vulnerability exists in the /admin/semcms_user.php endpoint, which accepts POST requests without proper CSRF token validation. An attacker can construct a forged POST request that leverages the implicit authentication of a logged-in admin session. Because the endpoint lacks synchronizer token patterns or SameSite cookie controls, the browser automatically includes session cookies when the admin visits a malicious site, allowing the attacker to perform state-changing operations. The CVSS 3.1 score of 6.3 (MEDIUM) reflects the requirement for prior authentication and limited scope, though impact spans confidentiality, integrity, and availability of user records.

Business impact

Compromised administrative functions can lead to unauthorized account creation, privilege escalation, user deletion, or data exposure within the CMS. An attacker with CSRF access can effectively obtain administrative control without cracking passwords. For organizations running SemCms 5.0 to manage content or user roles, this creates a pathway to insider-equivalent threats. Reputational risk increases if administrators are tricked into defacing content or leaking sensitive data stored in the CMS.

Affected systems

SemCms version 5.0 is confirmed vulnerable. The /admin/semcms_user.php endpoint is explicitly at risk. Organizations running SemCms 5.0 in any deployment—whether internet-facing or internal—should assume this vulnerability applies if the admin console is accessible and administrators regularly authenticate. Patch availability and scope for earlier or later versions should be verified against the SemCms project advisories.

Exploitability

Exploitation requires a low level of technical skill: an attacker crafts an HTML form or JavaScript payload embedded in a webpage or phishing email, targeting a known SemCms admin. The bar for triggering the vulnerability is low because no user interaction beyond visiting the malicious page is required (PR:L, UI:N in the CVSS vector). However, the attack is not remotely exploitable without social engineering; the admin must be logged in and must be tricked into visiting attacker-controlled content. Public exploit code availability is unknown; this is not listed in the CISA KEV catalog.

Remediation

Apply a patch from the SemCms project that adds CSRF token validation to the /admin/semcms_user.php endpoint. Verify the specific patch version against official SemCms release notes. In the interim, implement network-level controls: restrict admin console access to trusted IP ranges, enforce VPN for administrative access, and educate administrators about phishing and suspicious links. Monitor session logs for unexpected admin actions.

Patch guidance

Check the SemCms project repository or security advisory site for a patched version of 5.0 or upgrade to the next stable release that includes CSRF mitigations. Apply patches to all instances running SemCms 5.0. After patching, clear all active admin sessions to prevent exploitation via pre-existing tokens. Validate the fix by reviewing the patched /admin/semcms_user.php code to confirm the presence of CSRF token generation and validation logic.

Detection guidance

Look for POST requests to /admin/semcms_user.php originating from external or unusual referrer headers—particularly requests that lack expected CSRF tokens in form data or headers. Monitor admin session logs for unexpected account creation, permission changes, or user deletions that lack corresponding audit trails. Implement HTTP response header inspection to detect missing or weak SameSite cookie policies. Consider deploying a Web Application Firewall (WAF) rule that flags POST requests to admin endpoints without a valid referrer or CSRF token.

Why prioritize this

Although rated MEDIUM severity, this vulnerability warrants prompt patching because it directly enables administrative impersonation. The requirement for prior login reduces the attack surface compared to unauthenticated flaws, but administrators are frequently targeted by phishing. The vulnerability's presence in a user management endpoint amplifies risk: a successful exploit grants control over account creation and permissions. Organizations hosting multi-user CMS instances should prioritize this fix over lower-impact flaws.

Risk score, explained

CVSS 3.1 score of 6.3 (MEDIUM) reflects: (1) network-accessible endpoint (AV:N), (2) low attack complexity—no special conditions beyond a crafted POST (AC:L), (3) requirement for low-privilege login (PR:L), (4) no additional user interaction required beyond visiting the site (UI:N), and (5) impact limited to a single user context (S:U). Confidentiality, integrity, and availability are each affected by unauthorized account or permission changes. The score does not assume widespread exploitation; actual risk depends on exposure of the admin console and administrator vigilance.

Frequently asked questions