This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Edito | Edito CMS | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 13 Nov 2026 07:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted JWT containing an existing user identifier and, due to the lack of signature validation, obtain a valid, fully-signed session token for any account in the system. This allows the attacker to impersonate any user, including administrators. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released. | |
| Title | Improper Cryptographic Signature Verification in Edito CMS | |
| Weaknesses | CWE-347 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CERT-PL
Published:
Updated: 2026-11-13T07:26:21.814Z
Reserved: 2026-07-02T08:57:58.309Z
Link: CVE-2026-59074
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-13T08:17:17.347
Modified: 2026-11-13T15:40:51.780
Link: CVE-2026-59074
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-347
Improper Verification of Cryptographic Signature