CVE-2026-116210 Details
Description
Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.
A cross-site request forgery (CSRF) vulnerability has been identified in the Webasyst Framework Photos application, affecting versions through 4.4.0. The vulnerability arises because the Photos app does not enable the framework's opt-in CSRF protection, allowing remote attackers to perform backend actions. By luring logged-in Photos users to a malicious page, attackers can submit forged POST requests to various endpoints, such as photo deletion and album management, without the user's consent.
To address this vulnerability, add the line 'csrf' => true to the Photos app configuration file. This will enable CSRF protection by requiring validation of CSRF tokens on all POST requests to the Photos app.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/webasyst/webasyst-framework/issues/393 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/webasyst/webasyst-framework | [email protected] | Vendor |
| https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-apps/photos/lib/config/app.php | [email protected] | Source CodeVendor |
| https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-system/controller/waDispatch.class.php#L159-L161 | [email protected] | Source CodeVendor |
| https://github.com/webasyst/webasyst-framework/issues/393 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/webasyst-framework-through-4.4.0-photos-app-csrf-via-backend-actions | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Webasyst Framework | <= 4.4.0 (semver) |
CPE
Remediation
| |
| Webasyst Photos | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 31, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |