CVE-2016-20054 Nodcms Cross Site Request Forgery via admin endpoints
Attackers can trick administrators into performing unauthorized actions like creating users or changing settings via crafted forms.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-20054?
CVE-2016-20054 is a medium-severity vulnerability in nodCMS, published on 4 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.
Which versions are affected by CVE-2016-20054?
2 open source packages ship an affected version, including khodakhah/nodcms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
khodakhah/nodcms Packagist | All versions to 3.4.1 | None |
khodakhah/nodcms Packagist | All versions to 3.4.1 | None |
Products include Nodcms Nodcms.
How do I fix CVE-2016-20054?
No fix has been published for CVE-2016-20054 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-20054 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-20054 exists.
Other vulnerabilities in nodCMS
Sources
Also known as GHSA-3qcm-pj6q-w4c5.