CVE-2026-63301
Received Received - Intake

Authentication Bypass Leads to Primary Language Deletion in Quick.CMS

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: CERT.PL

Description
In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated administrator can bypass the UI-level restriction and delete the primary language by sending a direct HTTP request to the API endpoint. Successful deletion of the primary language results in a Denial of Service (DoS) of application. Critically, when combined with a separate Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-1468) an unauthenticated remote attacker can craft a malicious link, which if visited by an authenticated administrator, will trigger the DoS condition without direct access to the application The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-63301
EUVD
EUVD-2026-49754

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opensolution quick.cms to 6.8.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-602 The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Quick.CMS allows an authenticated administrator to delete the primary language via a direct API request, bypassing UI restrictions. When combined with a CSRF vulnerability (CVE-2026-1468), an unauthenticated attacker can trick an admin into triggering this deletion, causing a Denial of Service (DoS).

Detection Guidance

To detect this vulnerability, monitor for unauthorized HTTP requests targeting the language-deletion API endpoint in Quick.CMS. Check server logs for DELETE requests to endpoints like /api/languages/{id} where {id} corresponds to the primary language. Look for unusual activity from authenticated admin sessions or unexpected CSRF token failures.

Impact Analysis

The primary impact is a DoS condition where the application becomes unavailable due to deletion of the primary language. If exploited via CSRF, an attacker could remotely cause this without direct access to the system.

Compliance Impact

This vulnerability primarily causes a Denial of Service (DoS) by allowing deletion of the primary language in Quick.CMS, which could disrupt application functionality. It does not directly impact data confidentiality or integrity required by standards like GDPR or HIPAA. However, prolonged DoS conditions may indirectly affect compliance by impairing access to critical systems handling personal or health data.

Mitigation Strategies

Immediately restrict access to the language-deletion API endpoint by implementing server-side authorization checks. Ensure all administrative actions require re-authentication. Apply CSRF protections to all state-changing requests. Monitor for and block suspicious API calls targeting language management endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63301. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart