CVE-2026-9591 | Cross-site request forgery (CSRF) in NewsItemApiController i… | CVSS 8.3 HIGH

Description

Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to `/api/news-items`, due to missing anti-CSRF protection.

Metadata

CVE ID: CVE-2026-9591
State: PUBLISHED
Assigner: Checkmarx
Reserved: 2026-05-26 13:36 UTC
Published: 2026-06-17 13:41 UTC
Last updated: 2026-06-17 13:41 UTC
Primary CWE: CWE-352
CWE-352 Cross-Site request forgery (CSRF)
Vendor / Product: simplcommerce / SimplCommerce
Sources: cve.org · NVD

Severity & Metrics

8.3 HIGH CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

Affected products (1)

Vendor	Product	Platform	Versions
simplcommerce	SimplCommerce	—	0 < 6233d73e

Weakness (CWE)

CWE	Source	Description
CWE-352	cna	CWE-352 Cross-Site request forgery (CSRF)

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.3	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

References (2)