CVE-2026-16210: newpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authentication

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-19 · updated 2026-10-24
Weakness: CWE-287

Description

A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.get_action of the file simpleui/admin.py of the component AjaxAdmin AJAX Endpoint. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

newpanjing simpleui: 2026.01.13

References

https://github.com/newpanjing/simpleui/
https://github.com/newpanjing/simpleui/issues/537
https://vuldb.com/cve/CVE-2026-16210
https://vuldb.com/submit/857929
https://vuldb.com/vuln/380026
https://vuldb.com/vuln/380026/cti

Get alerted when CVE-2026-16210 or the next vulnerability affects your stack