CVE-2026-9591: SimplCommerce CSRF Vulnerability

CVE-2026-9591 Overview

CVE-2026-9591 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the NewsItemApiController of SimplCommerce. The flaw exists in versions prior to commit 6233d73e and stems from missing anti-CSRF protection on the /api/news-items endpoint. An unauthenticated remote attacker can craft a malicious form that, when submitted by an authenticated administrator's browser, creates or modifies news items with administrator privileges. The vulnerability requires user interaction from a logged-in administrator but no attacker authentication.

Critical Impact
A crafted form submission can leverage an administrator's session to create or modify content on the SimplCommerce storefront, enabling defacement, misinformation, or pivoting to client-side attacks against site visitors.

Affected Products

SimplCommerce (open-source .NET e-commerce platform) prior to commit 6233d73e
NewsItemApiController component handling /api/news-items requests
Deployments using SimplCommerce.Infrastructure.Web without the anti-forgery filter

Discovery Timeline

2026-06-17 - CVE-2026-9591 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-9591

Vulnerability Analysis

The vulnerability resides in SimplCommerce's news item management API. The NewsItemApiController accepts state-changing HTTP requests at /api/news-items without validating an anti-forgery token. Because session cookies are automatically attached by the browser on cross-origin form submissions, an attacker can host a malicious page that submits a forged request using the administrator's authenticated session.

The attack confidentiality impact is none, but integrity is high. The attacker influences both the vulnerable system and downstream subsequent systems serving content to end users. Successful exploitation allows arbitrary creation or modification of news items, which are typically rendered on the public storefront.

Root Cause

The root cause is the removal of the CookieOnlyAutoValidateAntiforgeryTokenAuthorizationFilter from the SimplCommerce request pipeline. This filter previously enforced anti-forgery token validation on cookie-authenticated state-changing requests while leaving JWT-bearer API calls unaffected. Without it, controllers such as NewsItemApiController accept POST, PUT, and DELETE operations without any cross-origin protection.

Attack Vector

An attacker hosts a page containing an auto-submitting HTML form that targets /api/news-items on the victim SimplCommerce instance. When an authenticated administrator visits the attacker's page, the browser submits the form along with the session cookie, and the server processes the request as a legitimate administrative action.

csharp

// Security patch restoring CookieOnlyAutoValidateAntiforgeryTokenAuthorizationFilter
// File: src/SimplCommerce.Infrastructure/Web/CookieOnlyAutoValidateAntiforgeryTokenAuthorizationFilter.cs
using System.Threading.Tasks;
using Microsoft.AspNetCore.Antiforgery;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc.Filters;

namespace SimplCommerce.Infrastructure.Web
{
    public class CookieOnlyAutoValidateAntiforgeryTokenAuthorizationFilter(IAntiforgery antiforgery) : IAsyncAuthorizationFilter
    {
        public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
        {
            var httpContext = context.HttpContext;
            if (HttpMethods.IsGet(httpContext.Request.Method) ||
                HttpMethods.IsHead(httpContext.Request.Method) ||
                HttpMethods.IsOptions(httpContext.Request.Method) ||
                HttpMethods.IsTrace(httpContext.Request.Method))
            // ... safe methods bypass validation; unsafe methods require a valid antiforgery token
        }
    }
}

Source: GitHub Commit 6233d73e

Detection Methods for CVE-2026-9591

Indicators of Compromise

Unexpected POST, PUT, or DELETE requests to /api/news-items with Origin or Referer headers pointing to external domains
News item records created or modified outside of administrator workstation IP ranges or normal business hours
Web server access logs showing successful 2xx responses to /api/news-items requests without a preceding GET to the admin UI
Audit log entries showing administrator actions that the administrator does not recognize

Detection Strategies

Inspect HTTP request logs for state-changing methods on /api/news-items lacking a RequestVerificationToken header or form field
Compare Referer/Origin headers on administrative API calls against the deployed SimplCommerce hostname
Correlate news item modification events with administrator browser activity, flagging changes that occur during web browsing of unrelated sites
Review the deployed Startup.cs and ServiceCollectionExtensions.cs to confirm whether CookieOnlyAutoValidateAntiforgeryTokenAuthorizationFilter is registered

Monitoring Recommendations

Forward web server and application logs to a centralized SIEM and alert on anomalous /api/news-items traffic patterns
Track the publication state of news items and alert on modifications outside of change management windows
Monitor administrator account activity for actions triggered without an interactive session in the admin UI
Enable Content Security Policy reporting to detect external pages framing or redirecting to the SimplCommerce admin

How to Mitigate CVE-2026-9591

Immediate Actions Required

Update SimplCommerce to a build that includes commit 6233d73e or later, which restores anti-forgery enforcement
Audit recent news item changes and roll back any unauthorized modifications
Require administrators to log out of the admin console when not actively performing administrative work
Restrict access to the /api/news-items endpoint to administrator workstations via network controls where feasible

Patch Information

The fix is delivered in SimplCommerce commit 6233d73e, which reinstates the CookieOnlyAutoValidateAntiforgeryTokenAuthorizationFilter and registers it through ServiceCollectionExtensions. The change is tracked in Pull Request #1150. Operators building from source should rebase onto a commit that includes this filter and redeploy.

Workarounds

Configure the reverse proxy to reject requests to /api/news-items that lack a same-origin Origin or Referer header
Set the session authentication cookie to SameSite=Strict to block cross-site cookie attachment on form submissions
Limit administrative access to a dedicated browser profile that is not used for general web browsing
Place the admin interface behind a VPN or IP allowlist to reduce exposure to cross-site attacks

bash

# Example NGINX reverse proxy rule enforcing same-origin on the vulnerable endpoint
location /api/news-items {
    if ($http_origin !~* ^https://admin\.example\.com$) {
        return 403;
    }
    if ($request_method ~ ^(POST|PUT|DELETE)$) {
        if ($http_referer !~* ^https://admin\.example\.com/) {
            return 403;
        }
    }
    proxy_pass http://simplcommerce_backend;
}