CVE-2026-67617 microweber CVE debrief

Who should care

Defenders and administrators of Microweber CMS installations should assess exposure and prioritize remediation due to the medium severity of the vulnerability. Security teams and vulnerability management teams should review the vulnerability and implement measures to prevent exploitation.

Why it matters

CVE-2026-67617 is a medium-severity vulnerability in Microweber CMS that allows admin-authenticated attackers to inject arbitrary JavaScript, enabling session riding and execution of malicious scripts without user interaction. Defenders and administrators of Microweber CMS installations should assess exposure and prioritize remediation.

• Session riding through same-origin fetch requests using the CSRF token embedded in the page
• Execution of malicious scripts without user interaction for every visitor to the public blog page and within the admin post editor

Technical summary

The Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system. The vulnerability allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tag_names parameter of the GET /api/save_content_admin endpoint, bypassing three independent sanitization controls including XSS middleware that ignores GET requests, a strip_unsafe() function that only matches double-quoted onerror attributes, and a titlecase normalizer that passes HTML decimal entity-encoded payloads through unchanged.

Defensive priority

Medium

Recommended defensive actions

• Review and update Microweber CMS to the latest version
• Restrict access to the /api/save_content_admin endpoint
• Implement additional security measures to prevent cross-site scripting attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the stored cross-site scripting vulnerability in Microweber CMS through 2.0.20. The vulnerability allows admin-authenticated attackers to inject arbitrary JavaScript via the tag_names parameter of the GET /api/save_content_admin endpoint. Additional review of the Microweber CMS codebase and version history may provide further context on the vulnerability and potential mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.