CVE-2026-60041
HighCVSS 8.1Summary
An unauthenticated remote attacker can perform a CSRF attack on a logged-in backend user, allowing execution of multiple critical system actions such as shutting down the server or restoring an uploaded backup.
Risk Assessment
This can result in a loss of integrity and availability through unauthorized actions performed in the context of a logged-in user.
Recommendation
Apply the vendor patches and implement CSRF protections such as anti-CSRF tokens and Origin header validation.
Other vulnerabilities in Backend web application
See all- CVE-2026-60046High
An unauthenticated remote attacker can perform password resets for any user with a known username and email without rate limiting.
- CVE-2026-60036High
A high-privileged remote attacker can perform code injection in the backend's patch activate function, leading to code execution.
- CVE-2026-60035High
A high-privileged remote attacker can perform code injection in the backend's network auth function, leading to code execution.
- CVE-2026-60043Critical
An unauthenticated remote attacker can perform an XSS attack on a logged-in backend user, allowing execution of multiple critical system actions such as shutting down the server or restoring an uploaded backup.
Original NVD description (English source)
An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS