CVE-2026-72601 — CSZ CMS CSZ CMS - Broken Access Control
A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the…
Published: 2026-08-11 · CVSS: 7.5 · CVSS 3.1
A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper fails open. An unauthenticated attacker can access all contact form submissions without credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7