Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-53952

GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw

CVSS 3.1 9.8 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-53952

Published

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a new administrator account. The application features an automated security control designed to delete the sensitive `admin/setup.php` file post-installation. However, this control is neutralized by a self-exclusion bug within the deletion logic, leaving the setup script accessible for unauthorized account creation even after a legitimate installation is completed. As of time of publication, no known patched versions are available.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-53952

Published

GetSimpleCMS-CE

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "GetSimpleCMS-CE",
                    "product": "GetSimpleCMS-CE",
                    "versions": [
                        {
                            "version": "<= 3.3.22",
                            "status": "affected"
                        }
                    ]
                }

GetSimpleCMS

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "GetSimpleCMS",
                    "product": "GetSimpleCMS",
                    "versions": [
                        {
                            "version": "<= 3.4.0a",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON