What is the CVSS score of CVE-2026-28281?

CVE-2026-28281 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Instantcms are affected by CVE-2026-28281?

InstantCMS installations running version 2.18.1 or earlier are vulnerable to cross-site request forgery (CSRF) attacks that could allow attackers to perform unauthorized administrative actions on…

How to fix or mitigate CVE-2026-28281?

Within 24 hours: Identify all InstantCMS instances in your environment and document current versions. Within 7 days: Subscribe to InstantCMS security advisories and monitor for patch availability; implement compensating controls listed below. Within 30 days: Apply vendor patch immediately upon release or migrate to alternative CMS if patch remains unavailable.

Instantcms CVE-2026-28281

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-10 security-advisories@github.com

CSRF Instantcms

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 17:38 nvd

HIGH 7.1

DescriptionGitHub Advisory

InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1.

AnalysisAI

InstantCMS is a free and open source content management system. versions up to 2.18.1 is affected by cross-site request forgery (csrf) (CVSS 7.1).

Technical ContextAI

This vulnerability (CWE-352: Cross-Site Request Forgery (CSRF)) affects InstantCMS is a free and open source content management system.. InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1.