Which versions of SimplCommerce are affected by CVE-2026-9591?

SimplCommerce deployments face a vulnerability (CVE-2026-9591) that could allow attackers to trick administrators into modifying website news and content without their knowledge.. A patch is available.

How to fix or mitigate CVE-2026-9591?

24 hours: Identify all SimplCommerce deployments and confirm installed version against vendor security advisory for CVE-2026-9591. 7 days: Deploy vendor patch to all instances; contact SimplCommerce for exact patched version number (fix confirmed in commit 6233d73e). 30 days: Audit news item modification logs for unauthorized activity during the exposure window and verify patch deployment across all systems.

SimplCommerce CVE-2026-9591

Q: What is the CVSS score of CVE-2026-9591?

CVE-2026-9591 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-17 Checkmarx

CSRF Simplcommerce

6.9

CVSS 4.0 · Vendor: Checkmarx

Severity by source

Vendor (Checkmarx) PRIMARY

6.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.4 HIGH

Network CSRF requires no attacker privileges but needs a logged-in admin to load attacker content (UI:R); abuse of the admin's session crosses authority boundaries (S:C); only integrity is impacted.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (Checkmarx).

CVSS VectorVendor: Checkmarx

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jun 18, 2026 - 14:22 NVD

HIGH MEDIUM

CVSS changed

Jun 18, 2026 - 14:22 NVD

8.3 (HIGH) 6.9 (MEDIUM)

Source Code Evidence Fetched

Jun 17, 2026 - 14:22 vuln.today

Analysis Generated

Jun 17, 2026 - 14:22 vuln.today

DescriptionCVE.org

Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to /api/news-items, due to missing anti-CSRF protection.

AnalysisAI

Cross-site request forgery in SimplCommerce's NewsItemApiController allows remote attackers to coerce an authenticated administrator's browser into creating or modifying news items via the /api/news-items endpoint, due to a disabled anti-forgery filter prior to commit 6233d73e. The CVSS 4.0 score of 8.3 reflects high integrity impact extending to subsequent systems (the admin's session), and no public exploit identified at time of analysis, though Checkmarx has published reference material describing the issue.

Technical ContextAI

SimplCommerce is an ASP.NET Core e-commerce platform. The underlying defect (CWE-352) stems from the project's custom CookieOnlyAutoValidateAntiforgeryTokenAuthorizationFilter, which was entirely commented out in source and therefore never registered as an MVC filter - meaning state-changing requests to /api/* endpoints, including NewsItemApiController, accepted any request bearing the admin session cookie without validating an antiforgery token. The fix re-implements the filter as an IAsyncAuthorizationFilter that calls antiforgery.ValidateRequestAsync on non-safe HTTP methods for /api paths when the user is authenticated via Identity.Application, and explicitly registers it via options.Filters.Add<...>() in ServiceCollectionExtensions.AddModules. Affected CPE is cpe:2.3:a:simplcommerce:simplcommerce:* (all versions prior to the patch commit).

RemediationAI

Upstream fix available (commit 6233d73e via PR #1150); released patched version not independently confirmed, so operators tracking main should update to a build that includes this commit and verify that CookieOnlyAutoValidateAntiforgeryTokenAuthorizationFilter is registered in ServiceCollectionExtensions.AddModules. If immediate upgrade is not possible, a compensating control is to register an equivalent global AutoValidateAntiforgeryTokenAttribute or a custom authorization filter that calls IAntiforgery.ValidateRequestAsync for unsafe HTTP methods on /api/* paths when the user holds an Identity.Application cookie - note the side effect that legitimate API clients calling /api/* with cookie auth must now submit a valid antiforgery token, which may break custom admin tooling. Network-level controls (restricting the admin panel and /api/news-items to a trusted IP range or VPN) reduce, but do not eliminate, exposure since an admin browsing the public internet while logged in remains the realistic attack surface. Refer to https://github.com/simplcommerce/SimplCommerce/pull/1150 for the authoritative patch.