CVE-2026-59074
Received Received - Intake

Improper JWT Signature Verification in Edito CMS

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: CERT.PL

Description
Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted​ ​JWT​ containing​ ​an existing user​ ​identifier and, due to the lack of signature validation,​​  obtain​ ​a ​​valid,​​ fully-signed​​ session ​​token​​ for​​ any ​​account ​​in​ ​the​ ​system. This allows the attacker to impersonate any user, including administrators. This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-59074
EUVD
EUVD-2026-124876

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Edito Edito CMS From 0 (inc) to 5.10.2607 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Edito CMS has a flaw where it fails to properly verify cryptographic signatures in JWT refresh tokens. An authenticated low-privilege user can craft a JWT containing another user's identifier and bypass signature validation to obtain a valid session token for any account, including administrators. This allows impersonation of any user.

Detection Guidance

Check Edito CMS version for vulnerability. If version is below 5.10.2607 or 5.8 without hotfix, it is likely affected. Monitor network traffic for unusual JWT token exchanges or session creation events.

Impact Analysis

An attacker could gain unauthorized access to any user account, including admin accounts, by exploiting this flaw. This could lead to data theft, unauthorized modifications, or complete system compromise depending on the compromised account's privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using Edito CMS may face compliance breaches, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies
  • Upgrade Edito CMS to version 5.10.2607 or apply hotfix for version 5.8.
  • Review and revoke all active sessions after applying the update.
  • Monitor logs for any signs of unauthorized access or session hijacking attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59074. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...