{"id":"CVE-2026-116210","kind":"vulnerability","aliases":["CVE-2026-116210"],"related":[],"title":"Webasyst Photos app: forged requests can delete photos and change access","description":"Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.","summary":"The Photos app in Webasyst Framework through 4.4.0 does not enable the framework's opt-in CSRF check, so it accepts POST requests forged from other sites. A lured logged-in user can have an attacker-chosen page delete photos or change album access rights.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"webasyst-framework","fixed":[],"affected":"<= 4.4.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["csrf","photos-app","php","runtime","self-hosted","webasyst"],"not_affected_if":["no-photos-app"],"how_to_check":"- Open wa-apps/photos/lib/config/app.php and look for 'csrf' => true; if absent (or false), the Photos app is exposed.\n- Framework version: check wa-config/ or the Webasyst Installer/About page; 4.4.0 or earlier is in the affected range per NVD.\n- Confirm Photos is installed: ls wa-apps/photos","fix":"No fixed version published in sources as of 2026-10-26 (unknown). Interim: add 'csrf' => true to wa-apps/photos/lib/config/app.php (per Webasyst CSRF docs; templates/AJAX must send the _csrf token, so test the Photos UI after the change). Watch the Webasyst updates page and https://github.com/webasyst/webasyst-framework for a fix.","status":"open","published_at":"2026-10-26T14:16:33+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:25+00:00","updated_at":"2026-10-26T14:33:16+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-26T14:32:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Webasyst Photos app: forged requests can delete photos and change access","impact":"medium","summary":"The Photos app in Webasyst Framework through 4.4.0 does not enable the framework's opt-in CSRF check, so it accepts POST requests forged from other sites. A lured logged-in user can have an attacker-chosen page delete photos or change album access rights.","category":"runtime","nicknames":[],"who_cares":["webasyst","self-hosted","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker deletes photos and changes album access for logged-in users","analyst_note":"Confirm the fixed version and the exact opt-in CSRF setting in the Webasyst framework from the NVD entry or vendor advisory; sources give no fix.","how_to_check":"- Check whether the Photos app is installed in the Webasyst instance and note its version\n- Look for the framework version in the installation (unknown exact file path in sources)","needs_analyst":true,"not_affected_if":["no-photos-app"],"who_is_affected":"Teams that run Webasyst Framework 4.4.0 or earlier with the Photos app installed and used by logged-in staff or users. Instances without the Photos app, or on a version newer than 4.4.0 if the sources confirm a fix, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000588,"input_tokens":3366,"output_tokens":502,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the exact opt-in CSRF setting in the Webasyst framework from the NVD entry or vendor advisory; sources give no fix.","search":"'-116210':14A,17A '-2026':13A,16A '4.4.0':38B,82C 'accept':52B 'access':11A,77B,144C 'action':102C 'album':76B 'album/save':136C 'allow':96C 'app':3A,24B,33B,94C,105C 'attack':69B,98C,117C 'attacker-chosen':68B 'backend':101C 'chang':10A,75B,143C 'check':49B,116C 'chosen':70B 'contain':83C 'cross':86C 'cross-sit':85C 'csrf':21B,48B,115C 'cve':12A,15A 'delet':7A,72B,140C 'enabl':41B,108C 'forg':4A,55B,131C 'forgeri':89C 'framework':20A,36B,43B,80C,110C 'host':29B 'log':62B,121C 'logged-in':61B,120C 'lure':60B,119C 'malici':127C 'opt':46B,113C 'opt-in':45B,112C 'page':71B,128C 'perform':100C 'photo':2A,8A,23B,32B,73B,93C,123C,141C 'photo/delete':135C 'photo/manageaccesssave':137C 'photo/savefield':139C 'photos-app':22B 'php':25B 'post':53B,132C 'remot':97C 'request':5A,54B,88C,133C 'right':78B,145C 'runtim':26B 'self':28B 'self-host':27B 'site':58B,87C 'submit':130C 'user':64B,124C 'vulner':90C 'webasyst':1A,19A,30B,35B,79C 'webasyst-framework':18A","nicknames":[],"mitigations":[],"who_affected":"Teams that run Webasyst Framework 4.4.0 or earlier with the Photos app installed and used by logged-in staff or users. Instances without the Photos app, or on a version newer than 4.4.0 if the sources confirm a fix, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116210","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116210","severity":null,"published_at":"2026-10-26T14:16:33+00:00","modified_at":"2026-10-26T14:16:33+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116210:831","url":null,"severity":null,"published_at":"2026-10-26T14:33:16+00:00","modified_at":"2026-10-26T14:33:16+00:00","first_seen_at":"2026-10-26T14:33:16+00:00","fetched_at":"2026-10-26T14:33:16+00:00","note":"Only NVD (VulnCheck CNA) found: affects Webasyst Framework through 4.4.0, Photos app lacks opt-in CSRF. No vendor advisory, fix version, PoC or exploitation found; Photos changelog (latest 2.3.0.121, Feb 2026) has no CSRF entry. Vendor CSRF doc confirms the opt-in is 'csrf' => true in wa-apps/APP_ID/lib/config/app.php. Nothing marked verified."}],"documents":[{"id":3881,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116210","title":"NVD CVE-2026-116210","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3882,"url":"https://developers.webasyst.com/docs/features/csrf/","title":"Webasyst docs: CSRF (opt-in 'csrf' => true in app.php)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3883,"url":"https://www.webasyst.com/store/app/photos/changelog/","title":"Photos app changelog","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}