CVE-2026-39170 Details

A Cross-Site Request Forgery (CSRF) vulnerability exists in SemCms versions through 5.0, specifically within the administrative user management module. The application fails to implement anti-CSRF token validation for user management operations, allowing an authenticated administrator to be manipulated into performing unintended actions via a crafted POST request to '/admin/semcms_user.php'.

To address this vulnerability, implement anti-CSRF tokens for all state-changing requests and validate these tokens server-side for every POST request. Additionally, enforce SameSite cookie attributes, verify request origins using Referer or Origin headers, apply strict session management for administrative operations, and ensure that user management functionalities are protected against CSRF attacks.