CVE-2026-9591: Cross-Site Request Forgery (CSRF) in SimplCommerce News Module

Synopsis

Cross-site request forgery (CSRF) affects the News module API controller in SimplCommerce prior to commit 6233d73e. An unauthenticated remote attacker can exploit this by tricking an administrator into submitting a crafted form, requiring no credentials of their own. Successful exploitation lets the attacker create or modify news items with administrator-level privileges, and also affects systems that depend on SimplCommerce data. A patched-image rebuild at commit 6233d73e is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the target SimplCommerce instance over the network in order to serve the crafted form to a victim.

• AuthenticationNot required

  The attacker needs no credentials; the exploit relies on the authenticated administrator's existing session rather than any account held by the attacker.

• Victim interactionRequired

  The attacker must socially engineer an administrator into loading or submitting a crafted form, for example by luring them to a malicious page while they are logged in.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental factors beyond getting the victim to interact.

Blast Radius

• The attacker can create or modify news items through the `/api/news-items` endpoint using the administrator's session, injecting arbitrary content into the site.
• Integrity of the SimplCommerce news catalog is fully compromised, with no authentication barrier protecting write operations.
• Downstream or integrated systems that consume SimplCommerce news data are also affected, as the CVSS vector notes high integrity impact on scope-changed components.