CVE-2026-72601: CSZ CMS Auth Bypass Vulnerability

CVE-2026-72601 Overview

CVE-2026-72601 is a broken access control vulnerability in CSZ CMS 1.3.2. The flaw exists in the admin form-submission viewer, which lacks an authentication check. The framework authentication helper fails open, allowing unauthenticated remote attackers to reach the administrative endpoint over the network. Attackers can read every contact form submission stored by the CMS, including personally identifiable information (PII) submitted by site visitors. The issue is classified under [CWE-284: Improper Access Control].

Critical Impact
Unauthenticated network attackers can exfiltrate all contact form submissions and associated PII from vulnerable CSZ CMS 1.3.2 deployments without credentials or user interaction.

Affected Products

CSZ CMS 1.3.2
Deployments exposing the admin form-submission viewer endpoint
Instances relying on the default framework authentication helper

Discovery Timeline

2026-08-11 - CVE CVE-2026-72601 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72601

Vulnerability Analysis

CSZ CMS 1.3.2 exposes an administrative viewer for contact form submissions. The viewer is intended to be reachable only by authenticated administrators. In this release, the controller handling the viewer does not enforce a session or role check before returning submission data. The framework authentication helper that should gate access fails open, returning a permissive result rather than denying the request.

An unauthenticated attacker sending a direct HTTP request to the viewer endpoint receives the full set of stored form submissions. Submissions frequently contain names, email addresses, phone numbers, and free-text messages, meeting the definition of PII under most regulatory frameworks. The vulnerability affects confidentiality only; integrity and availability of the CMS are not directly impacted.

Root Cause

The root cause is a missing authorization check on the admin form-submission viewer combined with a fail-open authentication helper. When the helper cannot evaluate a session, it returns a value the calling controller treats as authorized. This double failure means neither the controller nor the shared helper enforces the access control boundary the application design assumes.

Attack Vector

Exploitation requires only network access to the CMS web interface. The attacker issues an HTTP GET request to the admin form-submission viewer URL. No credentials, tokens, or user interaction are required. The response body contains submission records that the attacker can parse and harvest at scale. Because the request pattern mirrors normal administrative browsing, it can blend into web traffic without triggering signature-based controls.

Refer to the CSZ CMS GitHub repository for the affected source code and endpoint layout.

Detection Methods for CVE-2026-72601

Indicators of Compromise

Unauthenticated HTTP requests to the admin form-submission viewer path returning HTTP 200 with submission data
Access log entries for administrative form-submission URLs from IP addresses that never completed a login flow
Bursts of sequential requests iterating submission IDs from a single source

Detection Strategies

Correlate web server access logs against authentication logs to identify admin-path requests without a preceding successful login
Alert on any 200-response access to admin form-submission endpoints originating from external IP ranges
Deploy web application firewall (WAF) rules that require an authenticated session cookie for all /admin/ paths in CSZ CMS

Monitoring Recommendations

Enable verbose logging on the CSZ CMS admin controller and forward logs to a centralized SIEM for correlation
Track outbound data volumes from the web tier and alert on anomalous responses larger than typical admin pages
Monitor for scraping patterns such as high request rates against admin endpoints from single sources or known proxy networks

How to Mitigate CVE-2026-72601

Immediate Actions Required

Restrict network access to the CSZ CMS admin interface using IP allowlists or a VPN until a patched release is deployed
Place the admin form-submission viewer behind an upstream authentication proxy that enforces credentials before requests reach the application
Audit existing form submissions and notify affected data subjects if unauthorized access is suspected under applicable breach notification laws

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Monitor the CSZ CMS GitHub repository for security releases addressing the missing authorization check and the fail-open behavior in the authentication helper.

Workarounds

Block external access to the form-submission viewer route at the reverse proxy or WAF layer
Require HTTP basic authentication at the web server for all /admin/ paths as a compensating control
Temporarily disable the admin form-submission viewer feature if it is not required for daily operations

bash

# Nginx configuration example: restrict admin routes to trusted networks
location ~* ^/admin/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    auth_basic "CSZ CMS Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://cszcms_backend;
}