Critical vulnerability with CVSS score of 9.8 discovered in module for 1C-Bitrix

The Information Security Threats Data Bank (ISTDB) of the Federal Service for Technical and Export Control (FSTEC) of Russia has published information about vulnerability BDU:2026-08451 in a third-party module 'ISpring Gift Shop' for the CMS '1C-Bitrix: Site Management'. The issue has received a critical danger rating of 9.8 on the CVSS 3.1 scale.

According to the ISTDB, the vulnerability was caused by the lack of authentication when accessing a critical function. A remote attacker can exploit the issue to cause a denial-of-service. The presence of the vulnerability is not related to the core or standard components of 1C-Bitrix.

Websites with the module version 0.6.0 installed are at risk. The developer iSpring has fixed the issue in version 0.7.0. Resource owners are advised to check the installed version and perform an update via the official Marketplace. Updating the CMS itself does not replace the installation of the fix for the third-party module.