CVE-2026-39170: CSRF
SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcmsuser.php.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement server-side CSRF protection for the /admin/semcms_user.php endpoint: require and validate a per-request CSRF token for POST requests and reject any POSTs without a valid token.
SemCms 5.0 /admin/semcms_user.php CSRF protection = enabled (require per-request CSRF token) - Compensating control
Restrict access to the /admin/semcms_user.php endpoint to trusted IPs or internal management networks (via firewall, ACLs or reverse-proxy) and/or deploy a WAF rule to block unauthorized cross-site POST requests targeting that path.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39170?
CVE-2026-39170 has a medium severity score of 6.3.
How do I fix CVE-2026-39170?
To fix CVE-2026-39170, implement CSRF protection mechanisms such as anti-CSRF tokens in your application.
What type of vulnerability is associated with CVE-2026-39170?
CVE-2026-39170 is identified as a Cross Site Request Forgery (CSRF) vulnerability.
Which software is affected by CVE-2026-39170?
CVE-2026-39170 affects SemCms version 5.0.
What kind of attack can be executed using CVE-2026-39170?
An attacker can exploit CVE-2026-39170 by sending a crafted POST request to /admin/semcms_user.php.