{"id":"CVE-2026-59074","kind":"vulnerability","aliases":["CVE-2026-59074"],"related":[],"title":"Edito CMS: forged JWT refresh tokens let attackers impersonate any user","description":"Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted​ ​JWT​ containing​ ​an existing user​ ​identifier and, due to the lack of signature validation,​​  obtain​ ​a ​​valid,​​ fully-signed​​ session ​​token​​ for​​ any ​​account ​​in​ ​the​ ​system. This allows the attacker to impersonate any user, including administrators.\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.","summary":"Edito CMS does not check the signature on JWTs submitted to its refresh logic. A logged-in low-privilege user can forge a token for any existing account, including administrators, and receive a valid session token.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","edito-cms","jwt","other"],"not_affected_if":["patched-5.10.2607"],"how_to_check":"- Compare the installed Edito CMS version with `5.10.2607`; versions below it are affected.\n- Check whether the installation is on the 5.8 line, which the sources say also needed a hotfix.","fix":"- Edito CMS: upgrade to `5.10.2607`.\n- Edito CMS 5.8 line: apply the hotfix released for that line (the sources do not give its version).","status":"open","published_at":"2026-11-13T08:17:17+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","triaged_at":"2026-11-13T08:45:17+00:00","updated_at":"2026-11-13T08:45:17+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T08:45:17Z","model":"claude-haiku-5-5","output":{"fix":"- Edito CMS: upgrade to `5.10.2607`.\n- Edito CMS 5.8 line: apply the hotfix released for that line (the sources do not give its version).","reach":"unknown","title":"Edito CMS: forged JWT refresh tokens let attackers impersonate any user","impact":"high","summary":"Edito CMS does not check the signature on JWTs submitted to its refresh logic. A logged-in low-privilege user can forge a token for any existing account, including administrators, and receive a valid session token.","audience":"businesses","category":"other","nicknames":[],"who_cares":["edito-cms","jwt","cms"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker impersonates any user, including administrators, with valid session tokens","analyst_note":"","how_to_check":"- Compare the installed Edito CMS version with `5.10.2607`; versions below it are affected.\n- Check whether the installation is on the 5.8 line, which the sources say also needed a hotfix.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-5.10.2607"],"who_is_affected":"Any installation of Edito CMS running a version below `5.10.2607`, including the 5.8 line, is exposed. The attacker needs an existing account of any privilege level, so sites where all accounts are fully trusted face less risk, but any low-privilege account is enough to reach administrator sessions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001129,"input_tokens":4661,"output_tokens":1325,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-59074':14A,17A '5.10.2607':130C '5.8':135C 'account':52B,110C 'administr':54B,123C 'allow':115C 'also':137C 'attack':8A,117C 'authent':76C 'check':27B 'cms':2A,18B,21B,24B,62C 'containing​':87C 'crafted​':85C 'cryptograph':67C 'cve':12A,15A 'due':93C 'edito':1A,20B,23B,61C 'edito-cm':19B 'exist':51B,89C 'fix':127C 'forg':3A,46B 'for​​':108C 'fulli':104C 'fully-signed​​':103C 'hotfix':131C 'identifi':91C 'imperson':9A,119C 'improp':66C 'includ':53B,122C 'in​':111C 'issu':125C 'jwt':4A,22B,72C 'jwts':31B 'jwt​':86C 'lack':96C 'let':7A 'log':39B 'logged-in':38B 'logic':36B,74C 'low':42B,78C 'low-privileg':41B,77C 'obtain​':100C 'older':133C 'privileg':43B,79C 'receiv':56B 'refresh':5A,35B,73C 'releas':139C 'self':84C 'self-crafted​':83C 'session':59B,106C 'signatur':29B,68C,98C 'signed​​':105C 'submit':32B,82C 'system':113C 'the​':112C 'token':6A,48B,60B 'token​​':107C 'user':11A,44B,80C,121C 'user​':90C 'valid':58B,99C,102C 'verif':69C 'version':129C,134C 'vulner':64C","nicknames":[],"mitigations":[],"who_affected":"Any installation of Edito CMS running a version below `5.10.2607`, including the 5.8 line, is exposed. The attacker needs an existing account of any privilege level, so sites where all accounts are fully trusted face less risk, but any low-privilege account is enough to reach administrator sessions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cms","editocms","high","jwt","other"],"campaign_type":null,"search_a":"'-2026':13A,16A '-59074':14A,17A 'attack':8A 'cms':2A 'cve':12A,15A 'edito':1A 'forg':3A 'imperson':9A 'jwt':4A 'let':7A 'refresh':5A 'token':6A 'user':11A","search_b":"'account':52B 'administr':54B 'check':27B 'cms':18B,21B,24B 'edito':20B,23B 'edito-cm':19B 'exist':51B 'forg':46B 'includ':53B 'jwt':22B 'jwts':31B 'log':39B 'logged-in':38B 'logic':36B 'low':42B 'low-privileg':41B 'privileg':43B 'receiv':56B 'refresh':35B 'session':59B 'signatur':29B 'submit':32B 'token':48B,60B 'user':44B 'valid':58B","search_c":"'5.10.2607':130C '5.8':135C 'account':110C 'administr':123C 'allow':115C 'also':137C 'attack':117C 'authent':76C 'cms':62C 'containing​':87C 'crafted​':85C 'cryptograph':67C 'due':93C 'edito':61C 'exist':89C 'fix':127C 'for​​':108C 'fulli':104C 'fully-signed​​':103C 'hotfix':131C 'identifi':91C 'imperson':119C 'improp':66C 'includ':122C 'in​':111C 'issu':125C 'jwt':72C 'jwt​':86C 'lack':96C 'logic':74C 'low':78C 'low-privileg':77C 'obtain​':100C 'older':133C 'privileg':79C 'refresh':73C 'releas':139C 'self':84C 'self-crafted​':83C 'session':106C 'signatur':68C,98C 'signed​​':105C 'submit':82C 'system':113C 'the​':112C 'token​​':107C 'user':80C,121C 'user​':90C 'valid':99C,102C 'verif':69C 'version':129C,134C 'vulner':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59074","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59074","severity":null,"published_at":"2026-11-13T08:17:17+00:00","modified_at":"2026-11-13T08:17:17+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","fetched_at":"2026-11-13T08:44:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}