CVE-2026-116210

The record

Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.

Affected packages

Related vulnerabilities

• CVE-2026-110288 A cross-site request forgery vulnerability was identified in GitHub Enterprise Server… CWE-352
• CVE-2026-63433 MyTube is a self-hosted downloader and player for several video websites. CWE-352
• CVE-2026-121451 AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in… CWE-352
• CVE-2026-103420 Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5… CWE-352
• CVE-2026-120249 Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request… CWE-352
• CVE-2026-120206 Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back… CWE-352
• CVE-2026-120207 Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that… CWE-352
• CVE-2026-61826 Bazarr is a companion application to Sonarr and Radarr. CWE-352