CVE-2026-59074

CVSS 8.7 (high) · published 2026-11-13

Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted​ ​JWT​ containing​ ​an existing user​ ​identifier and, due to the lack of signature validation,​​  obtain​ ​a ​​valid,​​ fully-signed​​ session ​​token​​ for​​ any ​​account ​​in​ ​the​ ​system. This allows the attacker to impersonate any user, including administrators. This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.

Weakness: CWE-347

Source: NVD CVE-2026-59074

References

• https://cert.pl/posts/2026/11/CVE-2026-59074
• https://www.edito.pl/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.