# CVE-2026-39170: SemCms CSRF in admin user management module

Source: https://junglewise.ai/threats/cve-2026-39170-semcms-csrf-in-admin-user-management-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-39170 · Severity: info · CVSS 6.5 · Published 2026-06-09

SemCms, a content management system, contains a security flaw in its administrative user management module. An attacker can trick a logged-in administrator into visiting a malicious website, which then silently triggers actions in the SemCms dashboard without the administrator's knowledge. This could allow an attacker to create new unauthorized accounts or modify existing user permissions, potentially leading to a full takeover of the website.

Technologies: [SEMCMS](https://junglewise.ai/threats/technologies/semcms). Vendors: [SEMCMS](https://junglewise.ai/threats/vendors/semcms).

## Quick answers

**Is CVE-2026-39170 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39170 being exploited in the wild.

**How severe is CVE-2026-39170?** Informational severity, with a CVSS score of 6.5, published 9 June 2026.

**Which products and versions are affected?** SEMCMS 5.0 and earlier.

**Is there a fix for CVE-2026-39170?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-39170 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-39170?** Check whether you run SEMCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in SemCms version 5.0 and earlier due to a lack of anti-CSRF token validation in the /admin/semcms_user.php component. The application fails to verify the origin of state-changing POST requests or implement unique session-based tokens for user management operations. An attacker can exploit this by hosting a malicious HTML page that uses an auto-submitting form to target an authenticated administrator's session. Successful exploitation allows the attacker to perform unauthorized administrative actions, such as creating new users or modifying existing account details, with the privileges of the victim administrator. Mitigation requires implementing server-side CSRF token validation and utilizing SameSite cookie attributes.

## Affected products

- SemCms SemCms 5.0 and earlier

## Timeline

- 2026-06-05: disclosed: Initial discovery and Gist publication
- 2026-06-09: advisory: NVD publication date

## References

- [https://gist.github.com/ql288470-pixel/41e01787357416458212dbbfd06c6d73](https://gist.github.com/ql288470-pixel/41e01787357416458212dbbfd06c6d73)

## Related threats

- [SEMCMS SQL injection in SEMCMS_Banner.php](https://junglewise.ai/threats/cve-2026-108814-a-flaw-has-been-found-in-semcms-up-to-5-0-this-impacts-an)
- [SEMCMS improper authorization in user deletion](https://junglewise.ai/threats/cve-2026-108812-a-security-vulnerability-has-been-detected-in-semcms-up-to-5-0)
- [SEMCMS unauthenticated file upload in KindEditor interface](https://junglewise.ai/threats/cve-2026-96739-a-flaw-has-been-found-in-semcms-up-to-4-2-affected-by-this-issue)
- [SEMCMS unauthenticated database export in SEMCMS_copy.php](https://junglewise.ai/threats/cve-2026-39169-semcms-unauthenticated-database-export-in-semcms-copy-php)
- [SemCms SQL injection in SEMCMS_Products.php](https://junglewise.ai/threats/cve-2025-51660-semcms-sql-injection-in-semcms-products-php)