{"id":"EM-20261113-RC4P","url":"https://cyber.eventmonitor.net/incident/EM-20261113-RC4P/edito-cms-vulnerability-cve-2026-59074/","type":"cve","title":"Edito CMS Vulnerability (CVE-2026-59074)","subtitle":"CVE-2026-59074","subject":"CVE-2026-59074","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-13T10:55:00.000Z","firstSignal":"2026-11-13T08:17:17.347Z","lastSignal":"2026-11-13T10:55:00.000Z","updated":"2026-11-13T08:33:15.246Z","revision":1,"life":[{"status":"Born","at":"2026-11-13T10:55:00.000Z","why":"second independent source: C17 CERT Polska"},{"status":"Developing","at":"2026-11-13T10:55:00.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-13T08:17:17.347Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-13T10:55:00.000Z","what":"Born: second source, C17 CERT Polska. Page EM-20261113-RC4P created."}],"stages":[{"name":"Disclosed","at":"2026-11-13T08:17:17.347Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-13T08:17:17.347Z","detail":"CVSS 8.7"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":"2026-11-13T10:55:00.000Z","detail":"1 government and CERT sources"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-13T08:17:17.347Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-59074 (CVSS 8.7)","text":"Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted​ ​JWT​ containing​ ​an existing user​ ​identifier and, due to the lack of signature validation,​​  obtain​ ​a ​​valid,​​ fully-signed​​ session ​​token​​ for​​ any ​​account ​​in​ ​the​ ​system. This allows the attacker to impersonate any user, including administrators.\nThis issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59074"},{"at":"2026-11-13T10:55:00.000Z","source":"C17","sourceName":"CERT Polska","role":"Government","severity":2,"title":"Vulnerabilities in Edito CMS software","text":"CERT Polska has received a report about 8 vulnerabilities (from CVE-2026-59074 to CVE-2026-59081) found in Edito CMS software.","url":"https://cert.pl/en/posts/2026/11/CVE-2026-59074/"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-13T08:17:17.347","score":8.7,"severity":"HIGH","desc":"Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted​ ​JWT​ containing​ ​an existing user​ ​identifier and, due to the lack of signature validation,​​  obtain​ ​a ​​valid,​​ fully-signed​​…","product":"","seen":1794558795246},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}