CVE-2026-92383: PbootCMS User Management UserController.php mod cross-site request forgery
A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserController::del/UserController::mod of the file apps/admin/controller/system/UserController.php of the component User Management. Such manipulation leads to cross-site request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 3.2.25 is able to resolve this issue. The name of the patch is c25241a0964742cefb7f698efbb6c38b868d6ff7. It is advisable to upgrade the affected component.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PbootCMSto a version that resolves this vulnerability.Fixed in 3.2.25 - Upgrade
Upgrade
PbootCMSto a version that resolves this vulnerability.Patch c25241a0964742cefb7f698efbb6c38b868d6ff7
Event History
Frequently Asked Questions
Who is exposed to this issue?
PbootCMS deployments running version 3.2.24 or earlier are affected, specifically the User Management functionality implemented in apps/admin/controller/system/UserController.php. The affected operations are UserController::del and UserController::mod.
What does an attacker need to exploit it?
The attack can be performed remotely and requires user interaction, as indicated by the CVSS vector. No attacker privileges are required.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
What is the recommended remediation?
Upgrade PbootCMS to version 3.2.25. The referenced patch is c25241a0964742cefb7f698efbb6c38b868d6ff7.