CVE-2026-92383 PbootCMS User Management UserController.php mod cross-site request forgery
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-92383?
CVE-2026-92383 is a medium-severity vulnerability in PbootCMS, published on 16 Sep 2026.
Official description
A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserController::del/UserController::mod of the file apps/admin/controller/system/UserController.php of the component User Management. Such manipulation leads to cross-site request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 3.2.25 is able to resolve this issue. The name of the patch is c25241a0964742cefb7f698efbb6c38b868d6ff7. It is advisable to upgrade the affected component.
Which versions are affected by CVE-2026-92383?
How do I fix CVE-2026-92383?
No fix has been published for CVE-2026-92383 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92383 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92383 exists.
Sources
Also known as GHSA-g65h-8grw-v433.