CVE-2026-92383CWE-352CWE-862broken-access-controlcsrf

CVE-2026-92383

Medium · published September 16, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
13.7
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserController::del/UserController::mod of the file apps/admin/controller/system/UserController.php of the component User Management. Such manipulation leads to cross-site request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 3.2.25 is able to resolve this issue. The name of the patch is c25241a0964742cefb7f698efbb6c38b868d6ff7. It is advisable to upgrade the affected component.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00235 · 13.7th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-862 · Missing Authorization
Published
2026-09-16T19:19Z
References (7)
https://github.com/pbootcmspro/PbootCMS/commit/c25241a0964742cefb7f698efbb6c38b868d6ff7 · [email protected]https://github.com/pbootcmspro/PbootCMS/issues/70 · [email protected]https://github.com/pbootcmspro/PbootCMS/releases/tag/V3.2.25 · [email protected]https://vuldb.com/cve/CVE-2026-92383 · [email protected]https://vuldb.com/submit/938602 · [email protected]https://vuldb.com/vuln/405519 · [email protected]https://vuldb.com/vuln/405519/cti · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 15:00Z
    PbootCMS User Management UserController.php mod cross-site request forgery
    cvelistv5