Is CVE-2026-92383 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92383 being exploited in the wild.

How severe is CVE-2026-92383?

Medium severity, with a CVSS score of 4.3, published 16 September 2026.

Is there a fix for CVE-2026-92383?

A patch was published on 2026-09-07: Version 3.2.25 released with patch c25241a0964742cefb7f698efbb6c38b868d6ff7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92383 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-92383?

Check whether you run PbootCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92383: PbootCMS cross-site request forgery in user management

CVE-2026-92383 · Severity: medium · CVSS 4.3 · Published 2026-09-16

PbootCMS is a PHP-based content management system used to build and manage websites. The admin panel contains a user management module that allows administrators to add, edit, delete backend users, and change user status. Due to missing CSRF protection on sensitive GET endpoints, an attacker can trick a logged-in administrator into clicking a malicious link or visiting a page with an embedded image tag, causing the administrator to unknowingly delete other users or disable their accounts without any confirmation.

Technologies: PbootCMS. Vendors: PbootCMS.

Quick answers

Is CVE-2026-92383 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92383 being exploited in the wild.
How severe is CVE-2026-92383?: Medium severity, with a CVSS score of 4.3, published 16 September 2026.
Which products and versions are affected?: PbootCMS up to 3.2.24.
Is there a fix for CVE-2026-92383?: A patch was published on 2026-09-07: Version 3.2.25 released with patch c25241a0964742cefb7f698efbb6c38b868d6ff7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92383 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-92383?: Check whether you run PbootCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a cross-site request forgery (CSRF) flaw in PbootCMS's UserController class affecting the del() and mod() methods in apps/admin/controller/system/UserController.php. These methods perform sensitive write operations (user deletion and status modification) via GET requests without any CSRF token validation. The application's only CSRF protection mechanism (formcheck token validation in AdminController) is limited to POST requests and does not cover GET operations. An unauthenticated attacker can craft a malicious link or page containing an image/iframe pointing to the vulnerable endpoints (e.g., /admin.php?p=/User/del&ucode=10099), which will be executed when a logged-in administrator visits the attacker's page, leveraging the administrator's valid session cookie. The patch in version 3.2.25 converts these operations to POST and integrates them with the existing formcheck CSRF protection mechanism.

Affected products

PbootCMS PbootCMS up to 3.2.24

Timeline

2026-08-19: disclosed: Vulnerability reported on GitHub issue #70
2026-09-07: patched: Version 3.2.25 released with patch c25241a0964742cefb7f698efbb6c38b868d6ff7
2026-09-16: advisory: CVE-2026-92383 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.