Edito CMS November 2026 vulnerabilities cover eight CVEs disclosed by CERT Polska on November 13. Seven issues were fixed in Edito CMS 5.10.2607, with hotfixes also released for the older 5.8 branch. The eighth, CVE-2026-59080, remains a separate token-handling issue for which the vendor did not require a fix.
The eight records describe different access conditions and outcomes. An authenticated user could impersonate an administrator through the JWT refresh flaw, while code execution through the cache flaw requires a separate ability to change cache entries. Teams should inventory their Edito deployments before treating these as one interchangeable risk. For vulnerability triage, see Brandefense’s vulnerability intelligence platform.
Edito CMS November 2026 Vulnerabilities: Eight Distinct Issues
CERT Polska’s coordinated disclosure is the primary account for all eight CVEs. The grouped notes below distinguish an ordinary authenticated user, an administrator’s browser and the separate cache prerequisite. That distinction changes which evidence an owner should review first.
CVE-2026-59074: administrator impersonation
Edito CMS did not validate the signature of a JWT in its refresh logic. CERT Polska says an authenticated, low-privilege user could obtain a valid session token for another account, including an administrator. This makes account and session review a priority alongside patching.
CVE-2026-59075: data extraction through sorting
An authenticated attacker could place conditional expressions in administrative pagination sorting because input validation was inadequate. CERT Polska says the order of returned results could reveal field values character by character. The potential outcome is sensitive-data exposure, not direct server code execution.
CVE-2026-59076: script execution in the changelog
An authenticated user could store script content in profile name fields. CERT Polska says that script would execute in an administrator’s browser when the administrator views the admin changelog. This is a stored cross-site scripting issue involving an administrator’s viewing action.
CVE-2026-59077: script execution during editing
The Tiny editor content path could retain attacker-supplied HTML and JavaScript. According to CERT Polska, the code runs when someone tries to edit the changed entry. Administrators should examine unexpected edits and saved content while they coordinate the update.
CVE-2026-59078: script execution through avatars
CERT Polska separately describes stored script content in the avatar upload function. The script can run when a visitor opens the URL for a modified avatar. This browser-side issue is distinct from the unrestricted file upload in the next CVE.
CVE-2026-59079: unrestricted avatar file upload
The user interface restricts permitted file types, but the avatar upload function did not enforce those restrictions. CERT Polska says an attacker could upload a file with any type or extension. Review unexpected avatar uploads and the permissions available to accounts that can change avatars.
CVE-2026-59081: cache-dependent code execution
Edito CMS deserialized JSON without further validation. CERT Polska says normal application functions cannot be used to exploit this issue, even by an administrator. Server code execution becomes possible only if an attacker can modify or inject cache entries, so cache access is the key prerequisite.
CVE-2026-59080: short-lived token in browser history
Edito CMS sends a JWT through a GET request. CERT Polska says a local attacker with access to browser history could use a still-valid token to act as that user. The token expires after a short period, and the vendor judged exploitation very unlikely and a fix unnecessary.
Which Edito CMS Versions Need Action?
CERT Polska lists every version before 5.10.2607 as affected by CVE-2026-59074 through CVE-2026-59079 and CVE-2026-59081. It says those seven issues were fixed in 5.10.2607 and that hotfixes for version 5.8 were released. The disclosure does not name a specific 5.8 hotfix build, so operators should obtain and verify that build with Edito.
NVD lists CVSS 4.0 scores of 8.7 for CVE-2026-59074, 8.4 for CVE-2026-59081 and 2.1 for CVE-2026-59080. Its records give no CVSS 3.1 scores for these three entries. These ratings do not remove the separate cache prerequisite for CVE-2026-59081.
CVE-2026-59080 is listed separately as affecting versions through 5.10.2607, including that release. The vendor’s decision not to fix it means installing 5.10.2607 does not resolve that particular finding. Owners should keep the local browser-history exposure in their risk assessment instead of treating the new release as a blanket closure.
What Should an Edito CMS Owner Check Now?
Prioritize patching deployments that expose administrative functions to more users or networks. Our recommended review starts with unusual privileged sessions, administrative content changes, profile and avatar changes, and access to cache storage. These are defensive checks inferred from CERT Polska’s described paths; the advisory does not attribute an incident to a particular deployment.
- Inventory installationsRecord the deployed build, branch, owner and administrative access path.
- Apply the appropriate fixUpgrade to 5.10.2607 or obtain Edito’s applicable 5.8 hotfix.
- Verify the deployed buildConfirm the running version after maintenance, including each separately hosted instance.
- Review relevant changesExamine privileged sessions, content and avatar edits, and cache write permissions.
- Track the remaining issueAssess local access to browser histories for CVE-2026-59080.
The CMS and developer tool vulnerability archive provides context for other CMS disclosures. It does not determine the installed Edito build or replace the vendor’s hotfix confirmation.
From August 15 through November 13, 2026, Brandefense Blackhole counted seven dark-chat posts matching CVE-2026-59074. The same source recorded one matching post for CVE-2026-59081 and one for CVE-2026-59080. These are separate query counts that may overlap; a matching post is a discussion signal, not evidence of exploitation or an incident.
Frequently Asked Questions
Does Edito CMS 5.10.2607 address all eight CVEs?
No. CERT Polska says seven issues were fixed in 5.10.2607, while CVE-2026-59080 remains listed through that version and the vendor did not require a fix.
Can an Edito administrator exploit CVE-2026-59081 through normal CMS functions?
CERT Polska says normal application functions do not provide an exploitation path, even for administrators. Code execution requires the separate ability to modify or inject cache entries.
Which Edito CMS 5.8 hotfix build should teams install?
CERT Polska says 5.8 hotfixes were released but does not identify a specific build in its disclosure. Ask Edito for the applicable build and verify it after installation.
