CVE-2026-28281CWE-352

InstantCMS has Multiple CSRF Vulnerabilities

High · published March 9, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
6.2
In the wild
Unconfirmed
What it is

InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00171 · 6.2th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-03-09T22:13Z
EPSS history
Timeline
  • 09 MAR 22:13Z
    InstantCMS has Multiple CSRF Vulnerabilities
    cvelistv5