Edito CMS fixes eight flaws, including JWT forgery to admin access

Edito CMS fixes eight flaws, including JWT forgery to admin access

13 November 2026: Edito CMS, a content management system used by Polish organisations, has eight vulnerabilities, CVE-2026-59074 to CVE-2026-59081, the worst of which lets a low-privileged user forge a session token for any account, administrators included. CERT Polska, which coordinated the disclosure, says version 5.10.2607 fixes seven of them and hotfixes exist for 5.8; one is left unfixed.

Not yet independently verified. CERT Polska gives no CVSS scores and no exploitation status, and we have not found a separate advisory from the vendor. We will update this when it can be confirmed, and remove this note.

Token forgery and code execution

The most serious flaws are at the authentication and data layers.

• CVE-2026-59074: the JWT refresh logic does not validate signatures, so a logged-in user can forge a token carrying another user's ID and receive a valid session for that account.
• CVE-2026-59075: dynamic LINQ injection through the sort parameter of paginated admin endpoints lets an attacker infer stored values one character at a time.
• CVE-2026-59081: JSON is deserialised without validation, which CERT Polska says can lead to code execution on the server.

Stored scripts and uploads

Four more flaws affect content and profiles. CVE-2026-59076, 59077 and 59078 are stored cross-site scripting through the profile name fields at /api/auth/profile, content in the Tiny editor and avatar uploads. CVE-2026-59079 lets the avatar upload accept any file type.

The flaw that stays open

CVE-2026-59080 is the transmission of JWTs in GET query strings, where they can end up in proxy logs, browser history and referrer headers. It affects every release up to and including 5.10.2607, and the vendor has not fixed it, judging the likelihood of exploitation very low. Sites that keep the system should check where web server and proxy logs are stored and who can read them.

Fixed versions

• Edito CMS 5.10.2607: fixes CVE-2026-59074 to 59079 and 59081.
• Edito CMS 5.8: hotfixes available from the vendor.
• All releases through 5.10.2607: CVE-2026-59080 remains.

The flaws were found by Michał Majchrowicz, Dawid Małecki and Paweł Zdunek of the AFINE team. Because the token forgery needs only an ordinary account, sites that allow public registration or have many editors face the highest exposure. After upgrading, rotating the JWT signing configuration and reviewing recent administrator sessions would close off tokens forged before the fix. We list seven headless CMS platforms and nine enterprise content management products for teams weighing a move.

Related on TrustList:

• Drupal Commerce access bypass is exploited; update to 3.3.13
• Attackers drop webshells through YOOtheme Pro flaw CVE-2026-102785

Sources

• CERT Polska: Vulnerabilities in Edito CMS (CVE-2026-59074 to CVE-2026-59081), 13 November 2026