What is CVE-2026-71252?
CVE-2026-71252 is a missing authentication and authorization vulnerability in the toner-management plugin. The add.php, edit.php, and delete.php files under admin/toners, admin/toner-brands, and admin/printers perform database INSERT/UPDATE/DELETE operations without any access control. All admin state-changing handlers must be immediately patched to enforce authentication and authorization checks.
Azərbaycanca: CVE-2026-71252 toner-management plaginində autentifikasiya və avtorizasiya çatışmazlığıdır. admin/toners, admin/toner-brands, admin/printers altındakı add.php, edit.php, delete.php faylları heç bir yoxlama olmadan birbaşa verilənlər bazası əməliyyatları icra edir. Təcili olaraq bütün 'admin state-changing handler'lara autentifikasiya və icazə yoxlaması əlavə edilməlidir.
Related CVEs
link basis: same weakness class CWE-306
FAQ2
Which files are affected by CVE-2026-71252?
The add.php, edit.php, and delete.php files under the admin/toners, admin/toner-brands, and admin/printers directories are affected.
What type of database operations can be performed if CVE-2026-71252 is exploited?
INSERT, UPDATE, and DELETE operations can be performed on the database without any authentication or authorization checks.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.