What is the CVSS score of CVE-2026-30498?

CVE-2026-30498 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

AdminPanel CVE-2026-30498

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-27 cve@mitre.org

PHP CSRF

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:17 vuln.today

DescriptionCVE.org

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of Jason2605 AdminPanel 4.0.

AnalysisAI

Cross-Site Request Forgery in Jason2605 AdminPanel 4.0 exposes the delete.php endpoint to forged requests, allowing an unauthenticated remote attacker to perform unauthorized deletion operations by tricking an authenticated administrator into triggering the request. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable with no required attacker privileges, though victim interaction is mandatory. A publicly available proof-of-concept exists per SSVC classification, though no active exploitation (CISA KEV) has been confirmed at time of analysis.

Technical ContextAI

AdminPanel 4.0 is an open-source PHP-based administrative panel authored by Jason2605. CWE-352 (Cross-Site Request Forgery) identifies the root cause: the delete.php endpoint fails to validate the origin of state-changing HTTP requests, meaning it does not implement anti-CSRF tokens, SameSite cookie attributes, or equivalent server-side origin verification. Because browsers automatically include session cookies with cross-origin requests, a victim's authenticated browser session can be weaponized by any attacker-controlled page to issue forged DELETE-class operations against the panel without the victim's awareness. The vulnerability is confined to the PHP server-side logic and is not dependent on a specific PHP version or server configuration beyond a standard authenticated session being active.

Affected ProductsAI

Jason2605 AdminPanel version 4.0 is the confirmed affected product. The vulnerability is specifically located in the delete.php endpoint of this PHP application. No CPE string was provided in the source data, and no version range beyond 4.0 is indicated. Affected version scope (whether prior or later versions are also vulnerable) is not confirmed - version 4.0 is the only version cited in available intelligence. No official vendor advisory URL was found; the only references available point to a researcher-published GitHub repository at https://github.com/Mehdi-Ben-Hamou/CVE-2026-30498.

RemediationAI

No vendor-released patch identified at time of analysis - the only reference in available data is a researcher-published GitHub repository (https://github.com/Mehdi-Ben-Hamou/CVE-2026-30498) containing the POC, not a vendor advisory or patched release. As a primary compensating control, implement CSRF token validation on the delete.php endpoint: generate a cryptographically random, per-session token, embed it in all forms targeting delete.php as a hidden field, and reject any request where the submitted token does not match the server-side session value. As a secondary control, set the session cookie's SameSite attribute to Strict or Lax, which prevents browsers from sending cookies on cross-origin requests entirely - note this may break legitimate cross-domain SSO flows if any exist. Additionally, restrict access to the AdminPanel to trusted IP ranges via web server ACLs or firewall rules to reduce the attacker's ability to deliver the forged request. Operators should monitor the Jason2605 AdminPanel GitHub repository for upstream patches and apply them promptly once available.