Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck

CVE-2026-116210Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions

Medium 6.5

In plain English

A medium-severity cross-site request forgery in Webasyst Framework from Webasyst. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 93.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.

Affected products (as reported)

Vendor	Product	Versions
Webasyst	Webasyst Framework	0 – through 4.4.0

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

GitHub Issue #393 issue-tracking
https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-apps/photos/lib/config/app.php technical-description
https://github.com/webasyst/webasyst-framework/blob/cc609e5db23e68d982e15ebf65bf9d25120333af/wa-system/controller/waDispatch.class.php#L159-L161 technical-description
https://github.com/webasyst/webasyst-framework product
VulnCheck Advisory: Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions third-party-advisory