CVE-2026-59074
Gravedad CVSS v4.0:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
13/11/2026
Última modificación:
13/11/2026
Descripción
*** Pendiente de traducción *** Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted JWT containing an existing user identifier and, due to the lack of signature validation, obtain a valid, fully-signed session token for any account in the system. This allows the attacker to impersonate any user, including administrators.<br />
This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
Impacto
Puntuación base 4.0
8.70
Gravedad 4.0
ALTA