EUVD-2026-49754
GHSA-4pmv-mf66-4v3h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (cert) · only source for this CVE.
CVSS VectorVendor: cert
Lifecycle Timeline
2DescriptionCVE.org
In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated administrator can bypass the UI-level restriction and delete the primary language by sending a direct HTTP request to the API endpoint. Successful deletion of the primary language results in a Denial of Service (DoS) of application.
Critically, when combined with a separate Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-1468) an unauthenticated remote attacker can craft a malicious link, which if visited by an authenticated administrator, will trigger the DoS condition without direct access to the application
The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
AnalysisAI
Denial of service in Quick.CMS allows an authenticated administrator to delete the primary language by sending a direct HTTP request to the language-deletion API endpoint, bypassing the UI restriction, which renders the application unusable. The vendor deems a fix unnecessary due to very low exploitation likelihood, but chaining with a separate Cross-Site Request Forgery vulnerability (CVE-2026-1468) enables an unauthenticated remote attacker to craft a malicious link that, if visited by an authenticated admin, triggers the same DoS condition.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today