# CVE-2026-42286: Emlog CSRF in admin functions

Source: https://junglewise.ai/threats/cve-2026-42286-emlog-csrf-in-admin-functions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2026-42286 · Severity: info · CVSS 8.4 · Published 2026-05-08

Emlog, an open-source website building system, is vulnerable to an attack that can trick administrators into performing unintended actions. By visiting a malicious website while logged into the Emlog dashboard, an administrator could unknowingly change system settings, register unauthorized keys, or activate malicious plugins. This could lead to a full takeover of the website or unauthorized access to sensitive configuration data.

Technologies: [Emlog Pro](https://junglewise.ai/threats/technologies/emlog-pro). Vendors: [Emlog](https://junglewise.ai/threats/vendors/emlog).

## Quick answers

**Is CVE-2026-42286 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42286 being exploited in the wild.

**How severe is CVE-2026-42286?** Informational severity, with a CVSS score of 8.4, published 8 May 2026.

**Which products and versions are affected?** Emlog Pro < 2.6.11.

**Is there a fix for CVE-2026-42286?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42286 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-42286?** Check whether you run Emlog Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in Emlog's administrative interface due to a lack of anti-CSRF token validation in critical components, specifically /admin/auth.php and /admin/plugin.php. An attacker can exploit this by hosting a malicious page that sends unauthorized POST or GET requests to a victim's Emlog instance. If an authenticated administrator visits the malicious page, the attacker can execute actions with the administrator's privileges, including system registration (modifying 'emkey'), plugin activation/deactivation, and plugin deletion. This can lead to remote code execution if a malicious plugin is activated or significant configuration tampering. The issue is addressed in version 2.6.11 by implementing token generation and validation in the LoginAuth class.

## Affected products

- Emlog Emlog < 2.6.11

## Timeline

- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD

## References

- [https://github.com/emlog/emlog/security/advisories/GHSA-cqqp-rx28-gv2q](https://github.com/emlog/emlog/security/advisories/GHSA-cqqp-rx28-gv2q)

## Related threats

- [EMLOG-Pro cross-site scripting enabling shell upload](https://junglewise.ai/threats/cve-2026-88745-emlog-pro-2-6-29-contains-a-xss-vulnerability-that-enables)
- [Emlog Pro disabled TLS certificate validation in AI service](https://junglewise.ai/threats/cve-2026-67598-emlog-pro-disabled-tls-certificate-validation-in-ai-service)
- [Emlog Pro local file inclusion in article publishing interface](https://junglewise.ai/threats/cve-2026-46687-emlog-pro-local-file-inclusion-in-article-publishing-interface)
- [Emlog Pro path traversal in template upload feature](https://junglewise.ai/threats/cve-2026-39276-emlog-pro-path-traversal-in-template-upload-feature)
- [Emlog SQL injection in log_model.php](https://junglewise.ai/threats/cve-2026-42287-emlog-sql-injection-in-log-model-php)