# Edito CMS multiple vulnerabilities incl. JWT refresh signature bypass (CVE-2026-59074) enabling account takeover

> CERT Polska disclosed eight vulnerabilities in Edito CMS on 2026-11-13. CVE-2026-59074 (CWE-347) lets an authenticated low-privileged user forge a session token for any account, including administrators, because the JWT refresh logic does not validate signatures. Other flaws include dynamic LINQ injection, three stored XSS issues, unrestricted avatar upload and untrusted JSON deserialization; fixed in 5.10.2607 with hotfixes for 5.8.

- **Published:** 2026-11-14T00:31:03Z
- **Last reviewed:** 2026-11-14T00:31:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6013
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6013.png
- **ID:** TL-2026-6013
- **Severity:** HIGH (CVSS 8.7)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 5
- **CVEs:** CVE-2026-59074, CVE-2026-59075, CVE-2026-59076, CVE-2026-59077, CVE-2026-59078, CVE-2026-59079, CVE-2026-59080, CVE-2026-59081

## Description

CERT Polska published an advisory on 2026-11-13 covering eight vulnerabilities (CVE-2026-59074 through CVE-2026-59081) in Edito CMS, reported to CERT Polska by the AFINE Team (Michał Majchrowicz, Dawid Małecki, Paweł Zdunek). All but one affect every version before 5.10.2607.

CVE-2026-59074 (CWE-347) is the most severe. The JWT refresh logic checks token signatures incorrectly. A logged-in, low-privileged user can submit a self-made JWT containing an existing user's identifier and receive a valid, fully signed session token for that account. This enables impersonation of any user, including administrators. NVD records a CVSS 4.0 base score of 8.7 (High) from cvd@cert.pl with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

CVE-2026-59075 (CWE-917) is a dynamic LINQ injection. An authenticated attacker can inject conditional expressions into the sort parameter of paginated administrative endpoints and, by observing the order of returned results, extract any field's value one character at a time (a blind, boolean-style oracle), potentially exposing sensitive data.

Three stored XSS issues (CWE-79): CVE-2026-59076 via the givenName and surname parameters of /api/auth/profile, triggered when an administrator views the admin changelog logs; CVE-2026-59077 via the content parameter of the Tiny editor, triggered when a user opens the changed entry for editing; CVE-2026-59078 in the avatar upload feature, triggered when a user visits the URL of the edited avatar. The XSS in the changelog view gives a low-privileged user a path to run script in an administrator's browser.

CVE-2026-59079 (CWE-434): the UI restricts avatar uploads to certain file types, but the server accepts any file type and extension.

CVE-2026-59080 (CWE-598): Edito CMS sends JWT tokens in GET requests, so a local attacker with access to browser history could obtain a valid token and act as the victim. The token expires after a short period. The vendor rated exploitation as very unlikely and decided not to fix it, so it remains present through 5.10.2607.

CVE-2026-59081 (CWE-502): JSON is deserialized without further validation. The advisory states normal application functionality cannot trigger this, even by an administrator; an attacker able to modify or inject cache entries could execute code on the server.

The sources do not state active exploitation, a public PoC, attribution, or network IOCs. Severity HIGH is consistent with the NVD CVSS 4.0 score of 8.7 for CVE-2026-59074. The remaining CVEs have no score stated in the sources reviewed. NVD showed the CVE record as 'Deferred' at the time of review.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1606 Forge Web Credentials
- T1528 Steal Application Access Token
- T1213 Data from Information Repositories
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1203 Exploitation for Client Execution
- T1212 Exploitation for Credential Access
- T1552 Unsecured Credentials

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Edito CMS Host - IIS Worker Process Spawning Shell or LOLBin (CVE-2026-59081 Post-Exploitation)** (`TL-2026-6013-SPL-003`)

Detects the IIS worker process (w3wp.exe) hosting the .NET Edito CMS spawning a command interpreter or living-off-the-land binary. CVE-2026-59081 (CWE-502) allows server-side code execution when untrusted JSON in cache entries is deserialized; successful exploitation, or a web shell planted via the unrestricted avatar upload (CVE-2026-59079), surfaces as a shell child of w3wp.exe.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1203
- **Data sources:** sysmon, index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\w3wp.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\whoami.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\nltest.exe") | stats count min(_time) as first_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines by host User ParentImage Image | convert ctime(first_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "whoami.exe", "certutil.exe", "bitsadmin.exe", "mshta.exe", "rundll32.exe", "cscript.exe", "wscript.exe", "net.exe", "net1.exe", "nltest.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
```

### Sigma

```yaml
title: Edito CMS Host - IIS Worker Process Spawns Shell or LOLBin
id: 9d4a7c13-0e52-4b8f-a6d1-3c5f8e2b7a03
status: experimental
description: w3wp.exe spawning cmd, PowerShell or common LOLBins on an Edito CMS web server, consistent with code execution through untrusted JSON deserialization (CVE-2026-59081) or a web shell uploaded through the avatar feature (CVE-2026-59079).
references:
    - https://cert.pl/en/posts/2026/11/CVE-2026-59074/
author: Threadlinqs Team
date: 2026-11-14
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1203
    - cve.2026-59081
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\w3wp.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\whoami.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\cscript.exe'
            - '\wscript.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\nltest.exe'
    condition: selection
falsepositives:
    - Legitimate administrative scripts invoked by the web application
    - Deployment or health-check tooling run from the application pool
level: high

```

**Known false positives:**

- Web applications that intentionally shell out (report generators, image converters)
- Deployment or monitoring agents running under the application pool identity

**Tuning notes:** Baseline the child processes your Edito application pool legitimately launches and allow-list them by CommandLine. Restrict to the Edito application pool via ParentCommandLine (-ap pool name). Raise priority when the child is cmd/powershell with encoded or download-cradle arguments.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Edito CMS Stored XSS Payload in Profile or Editor Parameters (CVE-2026-59076 / CVE-2026-59077) (locked: unlock with TL Creds)
- Edito CMS Avatar Directory - Non-Image File Written by IIS Worker (CVE-2026-59079 / CVE-2026-59078) (locked: unlock with TL Creds)
- Edito CMS Single Client Presenting Multiple Identities Including Admin Area Access (Account Takeover) (locked: unlock with TL Creds)
- Edito CMS JWT Exposed in URL Query String - Token Replay Risk (CVE-2026-59080) (locked: unlock with TL Creds)
- Edito CMS Blind sort Oracle - High Volume of Distinct sort Values from One Account (CVE-2026-59075) (locked: unlock with TL Creds)
- Edito CMS Avatar URL Served with Active-Content Extension (CVE-2026-59078 / CVE-2026-59079) (locked: unlock with TL Creds)
- Edito CMS JWT Refresh Signature Bypass - Session Forged for Another Account (CVE-2026-59074) (locked: unlock with TL Creds)
- Edito CMS Dynamic LINQ Injection in sort Parameter (CVE-2026-59075) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Vulnerabilities in Edito CMS software (CERT Polska)](https://cert.pl/en/posts/2026/11/CVE-2026-59074/)
- [NVD API record for CVE-2026-59074](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-59074)
- [CVE.org record CVE-2026-59074](https://www.cve.org/CVERecord?id=CVE-2026-59074)
- [CVE.org record CVE-2026-59075](https://www.cve.org/CVERecord?id=CVE-2026-59075)
- [CVE.org record CVE-2026-59081](https://www.cve.org/CVERecord?id=CVE-2026-59081)
- [Edito vendor website](https://www.edito.pl/)
- [CERT Polska Coordinated Vulnerability Disclosure policy](https://cert.pl/en/cvd/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6013