CVE-2026-39170: SemCms 5.0 CSRF Vulnerability

CVE-2026-39170 Overview

CVE-2026-39170 is a Cross-Site Request Forgery (CSRF) vulnerability in SemCms 5.0. The flaw resides in the administrative user management endpoint /admin/semcms_user.php. An attacker can craft a malicious POST request that, when triggered by an authenticated administrator, performs unauthorized state-changing actions on the application. The vulnerability is tracked as CWE-352 (Cross-Site Request Forgery).

Critical Impact
Successful exploitation allows attackers to perform unauthorized administrative actions on SemCms 5.0 by tricking an authenticated admin into visiting a crafted page.

Affected Products

SemCms 5.0
/admin/semcms_user.php administrative endpoint
Deployments exposing the SemCms admin panel to authenticated users

Discovery Timeline

2026-06-09 - CVE-2026-39170 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-39170

Vulnerability Analysis

The vulnerability stems from missing CSRF protection on the /admin/semcms_user.php endpoint in SemCms 5.0. The endpoint accepts POST requests that modify user account state but does not validate the origin of the request through anti-CSRF tokens, custom headers, or SameSite cookie enforcement. An attacker hosts a malicious page containing an auto-submitting form or fetch request. When an authenticated SemCms administrator visits the attacker-controlled page, the browser automatically attaches the admin session cookie, and the request is processed as legitimate.

The impact aligns with CWE-352 outcomes: account creation, modification, or deletion within the SemCms admin panel without administrator consent. The attack requires the victim to hold an active SemCms admin session at the time of exploitation. No interaction beyond visiting the malicious page is needed.

Root Cause

The root cause is the absence of request-origin validation on a state-changing endpoint. SemCms 5.0 does not implement per-session anti-CSRF tokens, does not verify the Origin or Referer headers, and does not require re-authentication for sensitive user management operations. Refer to the GitHub Gist Exploit PoC for technical details on the request structure.

Attack Vector

The attack vector is network-based and requires social engineering. An attacker delivers a malicious URL to an authenticated SemCms administrator through phishing, a forum post, or a watering-hole site. When the victim's browser loads the page, an HTML form or JavaScript-based POST request is sent to /admin/semcms_user.php with attacker-chosen parameters. The browser includes the admin session cookie, and the server executes the requested user management operation.

Detection Methods for CVE-2026-39170

Indicators of Compromise

POST requests to /admin/semcms_user.php with Referer or Origin headers pointing to external, non-SemCms domains
Unexpected creation, modification, or deletion of administrator accounts in SemCms logs
Admin actions originating from sessions immediately after the administrator visited an external link
Spikes in 4xx/5xx responses on the admin endpoint indicating probing

Detection Strategies

Inspect web server access logs for POST requests to /admin/semcms_user.php with cross-origin Referer headers
Correlate admin user account changes with the originating IP, session, and Referer chain
Deploy a Web Application Firewall (WAF) rule that flags state-changing POST requests lacking an anti-CSRF token
Alert on browser sessions that issue admin POST requests within seconds of loading external HTML

Monitoring Recommendations

Forward SemCms web server and PHP application logs to a centralized SIEM for correlation
Track user account changes against an approved change-management baseline
Monitor administrative session creation and reuse patterns to detect anomalous request flows
Review outbound phishing and URL telemetry for links targeting SemCms admin users

How to Mitigate CVE-2026-39170

Immediate Actions Required

Restrict access to /admin/semcms_user.php to trusted internal IP ranges or a VPN segment
Require administrators to log out of SemCms when not actively managing the site
Configure session cookies with the SameSite=Strict or SameSite=Lax attribute to block cross-site submissions
Review SemCms admin account inventory for unauthorized additions or privilege changes

Patch Information

No official vendor patch is referenced in the NVD entry at the time of publication. Operators should monitor the SemCms project for an updated release that adds anti-CSRF token validation to administrative endpoints. Until a fix is available, apply the workarounds below.

Workarounds

Place SemCms behind a reverse proxy or WAF that injects and validates anti-CSRF tokens on POST requests
Enforce Referer and Origin header validation at the proxy layer for /admin/* paths
Implement network-level access control so the admin panel is unreachable from the public internet
Train administrators to avoid clicking untrusted links while authenticated to the SemCms console

bash

# Example nginx configuration restricting admin path and validating Origin
location /admin/ {
    allow 10.0.0.0/8;
    deny all;

    if ($request_method = POST) {
        set $csrf_ok 0;
        if ($http_origin ~* "^https://semcms\.example\.com$") { set $csrf_ok 1; }
        if ($csrf_ok = 0) { return 403; }
    }

    proxy_pass http://semcms_backend;
}