CVE-2026-53952

Received Received - Intake

Logic Flaw in GetSimple CMS Allows Admin Creation

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a new administrator account. The application features an automated security control designed to delete the sensitive `admin/setup.php` file post-installation. However, this control is neutralized by a self-exclusion bug within the deletion logic, leaving the setup script accessible for unauthorized account creation even after a legitimate installation is completed. As of time of publication, no known patched versions are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-53952

EUVD

EUVD-2026-76446

Affected Vendors & Products

Vendor	Product	Version / Range
getsimple	cms	3.4.0
getsimple	cms_ce	3.3.22

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-489	The product is released with debugging code still enabled or active.

Attack-Flow Graph

Executive Summary

This vulnerability is a logic flaw in GetSimple CMS and its community edition. It allows unauthenticated attackers to create a new administrator account by exploiting a self-exclusion bug in the automated security control that should delete the sensitive setup file after installation. The setup script remains accessible, enabling unauthorized access.

Detection Guidance

Check for the presence of the admin/setup.php file in your GetSimple CMS installation directory. If the file exists after installation, the system may be vulnerable. Use commands like 'ls -la /path/to/cms/admin/setup.php' on Linux or 'dir C:\path\to\cms\admin\setup.php' on Windows to verify its existence.

Impact Analysis

An attacker could gain full administrative control over your GetSimple CMS instance, allowing them to modify content, steal data, or disrupt operations. Since no patched versions are available, the risk remains until an update is released.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Manually delete the admin/setup.php file from your GetSimple CMS installation directory if it exists. Ensure no unauthorized administrator accounts have been created. Monitor for suspicious activity and restrict access to the CMS admin panel until a patch is available.

Hi! I’m here to help you understand CVE-2026-53952. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70