# CVE-2026-116210: Webasyst Framework cross-site request forgery in Photos app

Source: https://junglewise.ai/threats/cve-2026-116210-webasyst-framework-through-4-4-0-contains-a-cross-site-request  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-116210 · Severity: medium · CVSS 6.5 · Published 2026-10-26

Webasyst Framework is a platform that powers CRM, CMS, and ecommerce applications for businesses. The Photos app component fails to implement cross-site request forgery (CSRF) protection, allowing attackers to trick logged-in users into performing unwanted actions like deleting photos or changing access permissions by directing them to malicious websites. This could lead to data loss or unauthorized access to shared photos.

Technologies: [Webasyst Framework](https://junglewise.ai/threats/technologies/webasyst-framework). Vendors: [Webasyst](https://junglewise.ai/threats/vendors/webasyst).

## Quick answers

**Is CVE-2026-116210 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116210 being exploited in the wild.

**How severe is CVE-2026-116210?** Medium severity, with a CVSS score of 6.5, published 26 October 2026.

**Which products and versions are affected?** Webasyst Framework through 4.4.0.

**Is there a fix for CVE-2026-116210?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-116210 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116210?** Check whether you run Webasyst Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Photos app in Webasyst Framework through version 4.4.0 fails to enable the framework's opt-in CSRF protection mechanism, allowing attackers to forge POST requests to sensitive endpoints (photo/delete, album/save, photo/manageAccessSave, photo/saveField). An attacker can craft a malicious page that, when visited by a logged-in Photos user, submits unauthorized requests in the user's session context. No preconditions beyond user authentication and social engineering are required.

## Affected products

- Webasyst Framework through 4.4.0

## Timeline

- 2026-10-26: disclosed

## References

- [https://github.com/webasyst/webasyst-framework](https://github.com/webasyst/webasyst-framework)
- [https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-apps/photos/lib/config/app.php](https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-apps/photos/lib/config/app.php)

## Related threats

- [Webasyst Framework arbitrary file read via symlink in theme archive](https://junglewise.ai/threats/cve-2026-116213-webasyst-framework-through-4-4-0-contains-an-arbitrary-file-read)
- [Webasyst Framework stored XSS in Photos app album URL](https://junglewise.ai/threats/cve-2026-116212-webasyst-framework-through-4-4-0-contains-a-stored-cross-site)
- [Webasyst Framework arbitrary code execution via OAuth redirect_uri](https://junglewise.ai/threats/cve-2026-51954-an-issue-in-webasyst-framework-4-0-3-and-before-allows-a-remote)