CVE-2026-28281 — InstantCMS has Multiple CSRF Vulnerabilities

CVE-2026-28281

InstantCMS has Multiple CSRF Vulnerabilities PUBLISHED

Description (CNA)

InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1.

Affected (CNA)

Vendor / product	Versions
instantsoft / icms2	affected < 2.18.1

CWE

CWE-352

References

https://github.com/instantsoft/icms2/security/advisories/GHSA-pp43-262q-h73m

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.