CVE-2026-116210
Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions
Webasyst Webasyst Framework
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.
Text from CVE List
Affected versions 1
- Webasyst Frameworkaffected: all versions through 4.4.0CVE List
References 5
- vulncheck.com/advisories/webasyst-framework-through-4.4.0-photos-app-csrf-via-backend-actionsAdvisoryvia CVE List
- github.com/webasyst/webasyst-framework/issues/393Referencevia CVE List
- github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-apps/photos/lib/config/app.phpReferencevia CVE List
- github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-system/controller/waDispatch.class.php#L159-L161Referencevia CVE List
- github.com/webasyst/webasyst-frameworkReferencevia CVE List