CVE-2026-42286: Emlog: Cross-Site Request Forgery in Admin Functions
Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes. This issue has been patched in version 2.6.11.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42286?
CVE-2026-42286 has a medium severity rating due to the potential for unauthorized actions by attackers.
How do I fix CVE-2026-42286?
To fix CVE-2026-42286, upgrade Emlog to version 2.6.11 or later which includes proper CSRF protection.
What is the impact of CVE-2026-42286 on my Emlog installation?
CVE-2026-42286 allows attackers to exploit missing CSRF protections to perform unauthorized actions in the admin panel.
Who is affected by CVE-2026-42286?
Any installation of Emlog prior to version 2.6.11 is vulnerable to CVE-2026-42286.
What are the symptoms of exploitation of CVE-2026-42286?
Exploitation of CVE-2026-42286 may result in unexpected changes to site configurations or the installation of malicious plugins.