CVE-2026-42286CWE-352

Emlog: Cross-Site Request Forgery in Admin Functions

High · published May 8, 2026

CVSS v4.0
8.4
EPSS
0%
Percentile
11.2
In the wild
Unconfirmed
What it is

Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes. This issue has been patched in version 2.6.11.

The record
Technical detail
CVSS v4.0
8.4 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:H/SI:L/SA:L
EPSS
0.00214 · 11.2th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-05-08T21:51Z
EPSS history
Timeline
  • 08 MAY 21:51Z
    Emlog: Cross-Site Request Forgery in Admin Functions
    cvelistv5