CVE-2026-92383 Details
Description
A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserController::del/UserController::mod of the file apps/admin/controller/system/UserController.php of the component User Management. Such manipulation leads to cross-site request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 3.2.25 is able to resolve this issue. The name of the patch is c25241a0964742cefb7f698efbb6c38b868d6ff7. It is advisable to upgrade the affected component.
A cross-site request forgery (CSRF) vulnerability has been identified in PbootCMS versions through 3.2.24. The issue arises in the User Management component, specifically within the UserController::del() and UserController::mod() functions of the UserController.php file. These functions can be manipulated to perform unauthorized actions, such as deleting users or modifying their status, by exploiting the lack of CSRF protection on GET requests. The vulnerability can be exploited remotely by tricking an authenticated administrator into clicking a malicious link.
Users are advised to upgrade to PbootCMS version 3.2.25, where this vulnerability has been fixed. Instructions for upgrading can be found in the PbootCMS release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pbootcmspro/PbootCMS/commit/c25241a0964742cefb7f698efbb6c38b868d6ff7 | [email protected] | Source CodeVendor |
| https://github.com/pbootcmspro/PbootCMS/issues/70 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/pbootcmspro/PbootCMS/releases/tag/V3.2.25 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-92383 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/938602 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/405519 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/405519/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PbootCMS | <= 3.2.24 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |