Live › vulnerability › CVE-2026-116210
Go to dashboardThe Photos app in Webasyst Framework through 4.4.0 does not enable the framework's opt-in CSRF check, so it accepts POST requests forged from other sites. A lured logged-in user can have an attacker-chosen page delete photos or change album access rights.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Teams that run Webasyst Framework 4.4.0 or earlier with the Photos app installed and used by logged-in staff or users. Instances without the Photos app, or on a version newer than 4.4.0 if the sources confirm a fix, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| webasyst-framework | vendor | <= 4.4.0 | – |
csrf => true to wa-apps/photos/lib/config/app.php (per Webasyst CSRF docs; templates/AJAX must send the _csrf token, so test the Photos UI after the change)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.
This page as .md · .json · in your agent: get_signal("CVE-2026-116210")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.