CVE-2026-63301
Severity CVSS v4.0:
HIGH
Type:
Unavailable / Other
Publication date:
28/07/2026
Last modified:
30/07/2026
Description
In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated administrator can bypass the UI-level restriction and delete the primary language by sending a direct HTTP request to the API endpoint. Successful deletion of the primary language results in a Denial of Service (DoS) of application.<br />
<br />
<br />
Critically, when combined with a separate Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-1468) an unauthenticated remote attacker can craft a malicious link, which if visited by an authenticated administrator, will trigger the DoS condition without direct access to the application<br />
<br />
<br />
<br />
<br />
The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Impact
Base Score 4.0
7.00
Severity 4.0
HIGH