CVE-2026-92383: PbootCMS User Management CSRF Vulnerability

CVE-2026-92383 Overview

CVE-2026-92383 is a Cross-Site Request Forgery (CSRF) vulnerability affecting PbootCMS versions up to and including 3.2.24. The flaw resides in the UserController::del and UserController::mod functions within apps/admin/controller/system/UserController.php, which handle user management operations. An attacker can trick an authenticated administrator into submitting forged requests that modify or delete user accounts. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse. The vendor addressed the issue in version 3.2.25 via patch commit c25241a0964742cefb7f698efbb6c38b868d6ff7.

Critical Impact
Successful exploitation allows a remote attacker to perform unauthorized user management actions in the PbootCMS admin panel by leveraging an authenticated administrator's session.

Affected Products

PbootCMS versions up to and including 3.2.24
Component: User Management (apps/admin/controller/system/UserController.php)
Fixed in: PbootCMS 3.2.25

Discovery Timeline

2026-09-16 - CVE CVE-2026-92383 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92383

Vulnerability Analysis

The vulnerability [CWE-352] resides in the administrative user management endpoints of PbootCMS. The del and mod methods of UserController accepted requests without validating the origin or requiring a CSRF token bound to the admin session. As a result, a bare HTTP GET request containing the target ucode parameter could trigger a state-changing operation. An attacker hosting a malicious page or embedding a crafted link could cause a logged-in administrator's browser to issue the request automatically, resulting in unauthorized user deletion or modification.

Root Cause

The root cause is missing request-origin validation and enforcement of the POST method with anti-CSRF token verification. The pre-patch code path processed user deletion and modification without first checking that the request was submitted via POST or that a formcheck token existed. This allowed any HTTP method, including simple GET requests, to invoke privileged operations.

Attack Vector

Exploitation requires an authenticated administrator to visit an attacker-controlled page or click a crafted link while their PbootCMS admin session is active. User interaction is required, but no attacker privileges are needed. The request executes in the administrator's authentication context, allowing account modification or deletion within the User Management component.

php

// Patch: apps/admin/controller/system/UserController.php
// User deletion
public function del()
{
    // Reject bare GET; require POST (formcheck validated by AdminController)
    if (! $_POST) {
        error('请使用正确方式提交！', - 1);
    }
    
    if (! $ucode = get('ucode', 'var')) {
        error('传递的参数值错误！', - 1);
    }

Source: GitHub Commit c25241a

Detection Methods for CVE-2026-92383

Indicators of Compromise

Unexpected deletion or modification of administrator or user accounts in the PbootCMS ay_user table.
HTTP GET requests targeting /admin.php paths invoking UserController::del or UserController::mod with a ucode parameter.
Web server access logs showing requests to user management endpoints with Referer headers pointing to external, untrusted domains.

Detection Strategies

Review web server and application logs for state-changing requests to the User Management controller that use GET rather than POST.
Correlate administrator session activity with off-hours or geographically anomalous requests to apps/admin/controller/system/UserController.php handlers.
Alert on missing or invalid formcheck tokens on requests reaching admin controllers in unpatched deployments.

Monitoring Recommendations

Enable verbose access logging on the /admin.php entry point and forward logs to a central SIEM for retention and correlation.
Monitor administrative account inventories for unexpected additions, deletions, or privilege changes.
Track outbound HTTP referrers hitting admin URLs and flag any origin outside the trusted management perimeter.

How to Mitigate CVE-2026-92383

Immediate Actions Required

Upgrade PbootCMS to version 3.2.25 or later, which contains commit c25241a0964742cefb7f698efbb6c38b868d6ff7.
Restrict access to the PbootCMS admin panel to trusted IP ranges or a VPN to reduce CSRF exposure.
Require administrators to log out of the admin console when not actively performing management tasks.

Patch Information

The vendor released PbootCMS 3.2.25 with the fix. The patch enforces POST-only submission on UserController::del and UserController::mod so that the AdminControllerformcheck token validation applies to these operations. See the PbootCMS Release V3.2.25, the GitHub Commit Details, and the GitHub Issue Tracker for context.

Workarounds

Deploy a Web Application Firewall (WAF) rule blocking GET requests to UserController::del and UserController::mod endpoints.
Enforce SameSite=Strict on the admin session cookie to prevent cross-site request inclusion of session credentials.
Instruct administrators to use a dedicated browser or profile for PbootCMS management and avoid browsing untrusted sites in the same session.

bash

# Example WAF rule (ModSecurity) blocking GET to state-changing endpoints
SecRule REQUEST_METHOD "@streq GET" \
    "id:1092383,phase:1,deny,status:403,\
    chain,msg:'CVE-2026-92383 PbootCMS CSRF attempt'"
    SecRule REQUEST_URI "@rx /admin\.php.*(UserController.*(del|mod)|c=User&a=(del|mod))" \
        "t:lowercase"