Description
A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable information via the admin form-submission viewer. The viewer endpoint lacks an authentication check and the framework authentication helper fails open. An unauthenticated attacker can access all contact form submissions without credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CSZ CMS | CSZ CMS | ≤ 1.3.2 | — |