CVE-2026-116210

MEDIUM 6.5

Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.

CWE	CWE-352
Vendor	webasyst
Product	webasyst framework
Published	Oct 26, 2026

Stay Ahead of the Next One

Get instant alerts for webasyst webasyst framework

Be the first to know when new medium vulnerabilities affecting webasyst webasyst framework are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

Webasyst / Webasyst Framework

0 ≤ 4.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/webasyst/webasyst-framework/issues/393 github.com: https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-apps/photos/lib/config/app.php github.com: https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-system/controller/waDispatch.class.php#L159-L161 github.com: https://github.com/webasyst/webasyst-framework vulncheck.com: https://www.vulncheck.com/advisories/webasyst-framework-through-4.4.0-photos-app-csrf-via-backend-actions

Credits

Aaron Amran Bin Amiruddin