CVE-2026-60041: CSRF in backend
An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations with logged-in backend users are exposed. An unauthenticated remote attacker can target those users with a CSRF attack.
What does an attacker need to exploit the vulnerability?
The attacker does not need authentication and can act remotely, but exploitation requires a backend user to be logged in and to interact with the CSRF attack.
What actions could the attacker trigger?
The attacker may be able to execute multiple critical system actions, including shutting down the server or restoring an uploaded backup. These actions can affect system integrity and availability.