CSRF Vulnerability in InstantCMS Affects User Privileges and Task Execution
CVE-2026-28281

7.1HIGH

Key Information:

Vendor

Instantsoft

Status
Icms2
Vendor
CVE Published:
9 March 2026

What is CVE-2026-28281?

InstantCMS, a freely available open-source content management system, suffers from a significant security flaw prior to version 2.18.1 due to improper validation of CSRF tokens. This inadequacy enables malicious users to grant moderator rights to unauthorized individuals, manipulate scheduled tasks, remove posts, and approve friend requests, all without the victim's consent. To mitigate these risks, users are strongly advised to upgrade to version 2.18.1 or later, which addresses this vulnerability effectively.

Affected Version(s)

icms2 < 2.18.1

References

https://github.com/instantsoft/icms2/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.