CVSS 2.1 (low) · published 2026-11-13
Edito CMS sends JWT token via GET requests. This allows a local attacker with access to browser history to obtain valid JWT token and perform action on behalf of the victim. The token is valid for only short period of time; after that time, it expires and can no longer be used. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Weakness: CWE-598
Source: NVD CVE-2026-59080
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.