CVE-2026-72601

Name of the Vulnerable Software and Affected Versions CSZ CMS version 1.3.2

Description Broken access control allows unauthenticated remote attackers to read all form submissions, including personally identifiable information, through the admin form-submission viewer. This occurs because the viewer endpoint lacks an authentication check and the framework authentication helper fails open, enabling access to contact form submissions without credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.