What is GHSA-4q34-xwfg-pm6w?

GHSA-4q34-xwfg-pm6w is a security advisory published by GitHub Security Advisories with High severity. Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit...

Which CVE IDs does GHSA-4q34-xwfg-pm6w cover?

GHSA-4q34-xwfg-pm6w covers the following CVE IDs: CVE-2026-9591. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-4q34-xwfg-pm6wHigh

Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit...

Vendor

GitHub Security Advisories

Published

June 17, 2026

Last Modified

June 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-9591 →

📋 Description

Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to /api/news-items, due to missing anti-CSRF protection.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-9591
https://github.com/simplcommerce/SimplCommerce/pull/1150
https://github.com/simplcommerce/SimplCommerce/commit/6233d73e134c887fc3f3308d20710bec096d45e3
https://github.com/advisories/GHSA-4q34-xwfg-pm6w