Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-42286Emlog: Cross-Site Request Forgery in Admin Functions

High 8.4

In plain English

A high-severity cross-site request forgery in emlog from emlog. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 4.0)8.4High

Exploit odds (30 days)0.2%top 94.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes. This issue has been patched in version 2.6.11.

Affected products (as reported)

Vendor	Product	Versions
emlog	emlog	< 2.6.11

Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:H/SI:L/SA:L

References

https://github.com/emlog/emlog/security/advisories/GHSA-cqqp-rx28-gv2q x_refsource_CONFIRM