CVE-2026-53952

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a new administrator account. The application features an automated security control designed to delete the sensitive `admin/setup.php` file post-installation. However, this control is neutralized by a self-exclusion bug within the deletion logic, leaving the setup script accessible for unauthorized account creation even after a legitimate installation is completed. As of time of publication, no known patched versions are available.

• CWE-285
• CWE-306
• CWE-489

• https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-rw2c-w4mg-46g4

Published

Sep 11, 2026

Last Modified

Sep 14, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53947Ghost is a Node.js content management system. From 5.18.0 un…5.3
• CVE-2026-53948Ghost is a Node.js content management system. From 6.19.4 un…5.4
• CVE-2026-53949Ghost is a Node.js content management system. From 5.46.1 un…5.3
• CVE-2026-5395The Fluent Forms – Customizable Contact Forms, Survey, Quiz,…8.2
• CVE-2026-53950@tryghost/activitypub is Ghost’s social/federation client ap…7.5
• CVE-2026-53951Copier is a library and CLI app for rendering project templa…8.8
• CVE-2026-53954Bugsink is a self-hosted error tracking tool. Prior to versi…4.3
• CVE-2026-53956Rattler is a library that provides common functionality used…5.4
• CVE-2026-53957Contentful MCP Server is a Model Context Protocol server for…7.7
• CVE-2026-539584gaBoards is a boards system for realtime project management…7.6
• CVE-2026-539594gaBoards is a boards system for realtime project management…6.5
• CVE-2026-5396The Fluent Forms plugin for WordPress is vulnerable to Autho…8.2