CVE-2026-9591

Name of the Vulnerable Software and Affected Versions SimplCommerce versions prior to commit 6233d73e

Description Cross-site request forgery (CSRF) occurs in the NewsItemApiController. This issue allows an unauthenticated remote attacker to create or modify news items with administrator privileges by submitting a crafted form to the '/api/news-items' endpoint. The flaw is caused by a lack of anti-CSRF protection, which is a mechanism used to prevent unauthorized commands from being transmitted from a user that the web application trusts.

Recommendations Update to the version containing commit 6233d73e or later.