What is the CVSS score of CVE-2026-72601?

CVE-2026-72601 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of CSZ CMS are affected by CVE-2026-72601?

CSZ CMS 1.3.2 contains an unauthenticated remote access vulnerability that exposes all contact form submissions-including customer personally identifiable information-to potential data exfiltration.

How to fix or mitigate CVE-2026-72601?

Immediately restrict network access to the affected form-submission endpoint in CSZ CMS 1.3.2 or disable it entirely if operationally feasible; simultaneously enable audit logging on all requests to this endpoint. Within 7 days, contact CSZ CMS vendor support to confirm the patching timeline and test any available security releases or version upgrades (e.g., if version 1.4.x or later is available and addresses this vulnerability). Within 30 days, either apply the vendor-released patch once available or implement a reverse-proxy Web Application Firewall (WAF) with authentication token validation on the form-submission endpoint as interim containment.

CSZ CMS CVE-2026-72601

EUVD-2026-56040 HIGH

Improper Access Control (CWE-284)

2026-08-11 TuranSec

GHSA-8v5m-pr8j-m896

Authentication Bypass Csz Cms

7.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible endpoint requires no credentials or interaction; impact is confidentiality-only (read access to form data), with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:17 vuln.today

CVE Published

Aug 11, 2026 - 11:14 cve.org

HIGH 7.5

DescriptionCVE.org

A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper fails open. An unauthenticated attacker can access all contact form submissions without credentials.

AnalysisAI

Unauthenticated remote access to all contact form submissions, including personally identifiable information, is possible in CSZ CMS 1.3.2 due to a broken access control flaw in the admin form-submission viewer. The endpoint omits an authentication check entirely, and the underlying framework authentication helper fails open rather than denying access by default - meaning the bypass is a structural failure, not a simple missing decorator. No public exploit code or active exploitation has been identified at time of analysis, but the trivial exploitation conditions (no credentials, no special configuration) make this a realistic data-exposure risk for any internet-facing CSZ CMS deployment.

Technical ContextAI

CSZ CMS is a PHP-based content management system; the affected component is the administrative form-submission viewer, which exposes contact form data collected from site visitors. According to CWE-284 (Improper Access Control), the root cause is that the application fails to enforce an authorization policy at the viewer endpoint - the resource is accessible without proof of identity. Compounding this, the framework-level authentication helper is documented to fail open, meaning that when the helper is invoked (or not invoked), the default outcome is to permit rather than deny the request. The CPE string cpe:2.3:a:csz_cms:csz_cms:*:*:*:*:*:*:*:* and EUVD-2026-56040 scope the affected range as all versions from 0 through 1.3.2 inclusive.

RemediationAI

No vendor-released patch with a confirmed fixed version has been identified at time of analysis; the reference points only to the upstream GitHub repository at https://github.com/CSZ-CMS/CSZ-CMS-V1.3 and consumers should monitor that repository for commits or tagged releases that address authentication enforcement on the form-submission viewer. As an immediate compensating control, restrict access to the admin form-submission viewer endpoint at the web server or reverse-proxy layer (e.g., via Nginx location block or Apache mod_rewrite rule) to trusted IP ranges only - this prevents unauthenticated internet access without modifying application code, though it does not fix the underlying fail-open authentication helper. If the CMS is deployed behind an authentication gateway or WAF, enforce a session-validation rule for all /admin/* routes. Disabling the contact form feature entirely eliminates the data-exposure surface if the feature is not needed. Organizations collecting PII through contact forms should treat collected submissions as potentially compromised and notify affected individuals if the endpoint was publicly reachable prior to mitigation.