CSRF in Emlog

CVE-2026-31954

Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.002 (4.6th percentile) — read the EPSS interpretation.

Affected products

  • Emlog — versions <= 2.6.6

Weakness classification (CWE)

References