CVE-2026-72601 — CSZ CMS CSZ CMS - Broken Access Control

CVE-2026-72601

CSZ CMS CSZ CMS - Broken Access Control PUBLISHED

Description (CNA)

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper fails open. An unauthenticated attacker can access all contact form submissions without credentials.

Affected (CNA)

Vendor / product	Versions
CSZ CMS / CSZ CMS	affected 0 through 1.3.2

CWE

CWE-284

References

https://github.com/CSZ-CMS/CSZ-CMS-V1.3

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.