Squidex CMS CVE-2026-31016
MEDIUMSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CSRF requires victim user interaction (UI:R, not UI:N); privilege escalation via profile endpoint justifies I:H over I:L.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 and before allows a remote attacker to escalate privileges via the IdentityServer account profile endpoint
AnalysisAI
Cross-site request forgery in Squidex CMS v7.21.0 and earlier allows a remote attacker to escalate privileges by targeting the IdentityServer account profile endpoint without requiring any authentication of their own. A proof-of-concept exploit is publicly documented, including a video walkthrough, and SSVC analysis classifies the attack as automatable with partial technical impact. No active exploitation has been confirmed by CISA KEV at time of analysis.
Technical ContextAI
Squidex is an open-source headless CMS built on ASP.NET Core that uses IdentityServer - an OAuth 2.0 and OpenID Connect framework - for identity and access management. CWE-352 (Cross-Site Request Forgery) occurs when a web application fails to validate that state-changing HTTP requests originate from the legitimate authenticated user rather than a forged cross-origin request. In this case, the IdentityServer account profile endpoint accepts forged requests, allowing an attacker to manipulate profile-level data or escalate role/permission assignments. The CPE string in NVD is currently unpopulated (cpe:2.3:a:n/a:n/a:*), indicating the entry has not been fully processed by NVD, so version range confirmation relies on the vendor description and the public write-up at lgnas.gitbook.io.
RemediationAI
No vendor-released patch with a specific fix version has been identified in the available reference data; the GitHub repository link (github.com/Squidex/squidex) should be monitored for a patched release addressing CSRF protections on the IdentityServer account profile endpoint. As an immediate compensating control, administrators should enforce strict same-site cookie policies (SameSite=Strict or SameSite=Lax) on session cookies, which will prevent cross-origin requests from carrying credentials. Additionally, network-level access controls restricting the IdentityServer profile endpoint to trusted origins or authenticated management networks reduce exposure surface. Implementing CSRF token validation on all state-changing profile requests is the definitive server-side fix. Organizations relying on Squidex in externally-facing deployments should consider temporarily restricting access to the account profile endpoint until a vendor patch is released.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today