CyberRota Analysis
AI-GeneratedThe administrative interface of Quick.CMS fails to enforce server-side authorization for deleting the primary language, allowing authenticated administrators to bypass UI restrictions and trigger a Denial of Service (DoS) via direct API requests. This vulnerability is particularly concerning when combined with a separate Cross-Site Request Forgery (CSRF) flaw, enabling unauthenticated attackers to exploit the issue through crafted links. Organizations using Quick.CMS should prioritize addressing this vulnerability to prevent potential service disruptions, especially those with administrative access exposed to untrusted networks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated administrator can bypass the UI-level restriction and delete the primary language by sending a direct HTTP request to the API endpoint. Successful deletion of the primary language results in a Denial of Service (DoS) of application. Critically, when combined with a separate Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-1468) an unauthenticated remote attacker can craft a malicious link, which if visited by an authenticated administrator, will trigger the DoS condition without direct access to the application The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.