CVE-2026-53952: GetSimple CMS Auth Bypass Vulnerability

CVE-2026-53952 Overview

CVE-2026-53952 is a logic flaw in GetSimple CMS and its community edition, GetSimpleCMS-CE, that allows unauthenticated attackers to create new administrator accounts. The flaw affects GetSimple CMS versions 3.4.0a and below, and GetSimpleCMS-CE versions 3.3.22 and below. An automated post-installation control is designed to delete admin/setup.php, but a self-exclusion bug in the deletion logic leaves the setup script accessible after installation completes. Attackers can reach the exposed script over the network and register a privileged account without credentials. No patched versions are available at the time of publication.

Critical Impact
Unauthenticated remote attackers can create administrator accounts on affected GetSimple CMS and GetSimpleCMS-CE installations, resulting in full site compromise.

Affected Products

GetSimple CMS versions 3.4.0a and below
GetSimpleCMS-CE versions 3.3.22 and below
Installations retaining the admin/setup.php script

Discovery Timeline

2026-09-11 - CVE-2026-53952 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-53952

Vulnerability Analysis

The vulnerability is a broken access control issue classified under [CWE-285]. GetSimple CMS exposes admin/setup.php during installation to configure the first administrator account. After installation, an automated routine is supposed to delete the setup script to prevent reuse. The routine contains a self-exclusion bug: the logic that deletes sensitive installation files excludes setup.php itself. As a result, the script remains reachable on production installations and continues to accept new administrator registration requests without authentication.

An attacker who reaches the endpoint over the network can submit a crafted request to register a new administrator account. That account grants full control of the CMS, including content modification, theme and plugin management, and code execution paths that GetSimple exposes to administrators.

Root Cause

The root cause is a logic error in the post-installation cleanup routine. The deletion function iterates over installation artifacts but excludes setup.php from its own removal target list. The setup script itself lacks an independent authorization check to verify that installation has already completed, so it processes new administrator creation requests indefinitely.

Attack Vector

Exploitation requires only network access to the affected installation. The attacker sends a request to admin/setup.php and supplies parameters to create a new administrator account. No credentials, user interaction, or elevated privileges are required. Technical details are described in the GitHub Security Advisory GHSA-rw2c-w4mg-46g4.

Detection Methods for CVE-2026-53952

Indicators of Compromise

Presence of admin/setup.php on a production GetSimple CMS or GetSimpleCMS-CE installation after initial setup completed
HTTP requests to /admin/setup.php originating from external or unexpected source addresses
New entries in the administrator user store that do not correspond to authorized provisioning activity
Modifications to files under data/users/ immediately following requests to setup.php

Detection Strategies

Scan web roots for the presence of admin/setup.php on installations that have already been provisioned
Alert on any HTTP POST request targeting /admin/setup.php in web server access logs
Baseline the administrator account list and alert on additions that occur outside of change-management windows

Monitoring Recommendations

Forward web server access logs and CMS audit logs to a centralized analytics platform for correlation
Monitor filesystem changes to data/users/ and the admin/ directory on GetSimple CMS hosts
Track outbound connections initiated by the web server following administrator account creation events

How to Mitigate CVE-2026-53952

Immediate Actions Required

Delete or rename admin/setup.php on every GetSimple CMS and GetSimpleCMS-CE deployment
Restrict access to the admin/ directory using web server access controls, limiting it to trusted source addresses
Audit the administrator account list and remove any accounts that cannot be attributed to authorized users
Rotate credentials and API tokens for any account that could have been created or altered through the setup script

Patch Information

No patched versions are available at the time of publication. Track the GitHub Security Advisory GHSA-rw2c-w4mg-46g4 for updates from the maintainers.

Workarounds

Manually remove admin/setup.php from the web root after installation
Place a web server rule that returns HTTP 403 for any request matching /admin/setup.php
Deploy a web application firewall rule to block requests to the setup endpoint from untrusted networks
Consider isolating affected installations behind authenticated reverse proxies until a vendor patch is released

bash

# Configuration example: remove the setup script and block the path in nginx
rm /var/www/getsimple/admin/setup.php

# nginx location block
location = /admin/setup.php {
    return 403;
}