CVE-2026-116210
Received Received - Intake

Cross-Site Request Forgery in Webasyst Photos App

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulnCheck

Description
Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116210
EUVD
EUVD-2026-109803

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Webasyst Webasyst Framework 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site request forgery (CSRF) flaw in the Webasyst Framework up to version 4.4.0, specifically in the Photos app. It allows attackers to trick authenticated users into submitting unauthorized POST requests to backend endpoints like photo/delete, album/save, or photo/manageAccessSave. This can lead to actions such as deleting photos or changing access permissions without the user's consent.

Detection Guidance

Detecting this vulnerability requires checking if the Webasyst Framework Photos app is running version 4.4.0 or earlier. Inspect the framework version in your Webasyst installation directory or admin panel. Look for unauthorized POST requests to endpoints like photo/delete, album/save, photo/manageAccessSave, or photo/saveField in server logs.

Impact Analysis

If you are a user of the Webasyst Photos app, an attacker could exploit this to delete your photos or alter their access settings. This could result in data loss or unauthorized sharing of your content. The attack requires tricking you into visiting a malicious page while logged into the Photos app.

Compliance Impact

This vulnerability could lead to unauthorized modifications or deletions of sensitive data, potentially violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using Webasyst may face compliance risks if this flaw is exploited to access or alter regulated data.

Mitigation Strategies

Upgrade the Webasyst Framework to version 4.4.1 or later to enable the CSRF protection. If upgrading is not immediately possible, disable the Photos app or restrict access to POST endpoints like photo/delete and album/save. Monitor server logs for suspicious POST requests to these endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116210. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart