CVE-2026-116210: Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions

Q: Who can be targeted by this issue?

A logged-in user of the Photos app can be targeted if they can be lured to an attacker-controlled malicious page. The attack is remote and does not require the attacker to authenticate.

Q: What actions can forged requests perform?

Forged POST requests can target photo/delete, album/save, photo/manageAccessSave, or photo/saveField. This can delete photos or change photo access rights.

Q: Are user interactions required for exploitation?

Yes. The targeted Photos user must visit a malicious page while logged in, allowing that page to submit the forged request.

Q: What configuration condition causes the exposure?

The affected Photos app does not enable the framework's opt-in CSRF check. The provided information identifies this condition but does not describe an alternative mitigation or configuration workaround.

Published Oct 26, 2026

Updated

Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.

Affected Software

1 affected component

Webasyst Webasyst Framework<=4.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Enable the framework's opt-in CSRF check for backend actions in the Photos app.
Webasyst Framework Photos app framework opt-in CSRF check = enabled

Event History

Oct 26, 2026

CVE Published

via MITRE·01:08 PM

Data Sourced

via MITRE·01:08 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can be targeted by this issue?

A logged-in user of the Photos app can be targeted if they can be lured to an attacker-controlled malicious page. The attack is remote and does not require the attacker to authenticate.

What actions can forged requests perform?

Forged POST requests can target photo/delete, album/save, photo/manageAccessSave, or photo/saveField. This can delete photos or change photo access rights.

Are user interactions required for exploitation?

Yes. The targeted Photos user must visit a malicious page while logged in, allowing that page to submit the forged request.

What configuration condition causes the exposure?

The affected Photos app does not enable the framework's opt-in CSRF check. The provided information identifies this condition but does not describe an alternative mitigation or configuration workaround.

CVE-2026-116210: Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can be targeted by this issue?

What actions can forged requests perform?

Are user interactions required for exploitation?

What configuration condition causes the exposure?

Company

Resources

Contact

Frequently Asked Questions

Who can be targeted by this issue?

What actions can forged requests perform?

Are user interactions required for exploitation?

What configuration condition causes the exposure?