Stored Cross-Site Scripting Vulnerability in Edito CMS
CVE-2026-59076

5.1MEDIUM

Key Information:

Vendor

Edito

Status
Edito Cms
Vendor
CVE Published:
13 November 2026

What is CVE-2026-59076?

Edito CMS has a vulnerability that allows an authenticated attacker to exploit improper input validation via the /api/auth/profile endpoint. By injecting malicious scripts into the givenName and surname parameters, the attacker can execute these scripts in the administrator's browser when they access the admin changelog logs. This issue affects several versions of Edito CMS and has been addressed in version 5.10.2607, along with hotfixes for older versions.

Affected Version(s)

Edito CMS 0 < 5.10.2607

References

https://cert.pl/posts/2026/11/CVE-2026-59074
third-party-advisory
https://www.edito.pl/
product

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Dawid Małecki (AFINE Team)
​Paweł Zdunek (AFINE Team)
.