CVE-2026-116210 Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116210?
CVE-2026-116210 is a high-severity vulnerability in Webasyst Framework, published on 26 Oct 2026.
Official description
Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.
Weakness: CWE-352
Which versions are affected by CVE-2026-116210?
How do I fix CVE-2026-116210?
No fix has been published for CVE-2026-116210 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116210 being exploited?
There is no known exploitation of CVE-2026-116210 in the wild and no public exploit code.
Sources
Also known as GHSA-j7f6-9r44-r4f9.