CVE-2026-59074 · Other
NO FIX YET · SEE WHAT TO DO
Edito CMS does not check the signature on JWTs submitted to its refresh logic. A logged-in low-privilege user can forge a token for any existing account, including administrators, and receive a valid session token.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any installation of Edito CMS running a version below 5.10.2607, including the 5.8 line, is exposed. The attacker needs an existing account of any privilege level, so sites where all accounts are fully trusted face less risk, but any low-privilege account is enough to reach administrator sessions.
Not affected if patched-5.10.2607
Who cares cms, edito-cms, jwt
5.10.2607; versions below it are affected.5.10.2607.Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted JWT containing an existing user identifier and, due to the lack of signature validation, obtain a valid, fully-signed session token for any account in the system. This allows the attacker to impersonate any user, including administrators. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.