CVE-2026-9591

Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to `/api/news-items`, due to missing anti-CSRF protection.

Score

CVSS 4.0 6.9 Medium

Status

Deferred - 596c5446-0ce5-4ba2-aa66-48b3b757a647

Published

2026-06-17

Last modified

2026-06-18

Weaknesses

CWE-352

Affected products

• Simplcommerce (Simplcommerce)

References

• https://github.com/simplcommerce/SimplCommerce/commit/6233d73e134c887fc3f3308d20710bec096d45e3
• https://github.com/simplcommerce/SimplCommerce/pull/1150