The vulnerability CVE-2026-16210 affects newpanjing simpleui version 2026.01.13. It is caused by missing authentication checks in the self.get_action function of the simpleui/admin.py file, which is part of the AjaxAdmin AJAX Endpoint. This allows remote attackers to manipulate the endpoint and bypass authentication requirements. The vulnerability has been publicly disclosed with an available exploit, but no official remediation or patch has been released by the vendor as of the publication date.

Remote attackers can exploit this vulnerability to perform unauthorized actions through the AjaxAdmin AJAX Endpoint without authentication. This could lead to unauthorized access or manipulation of the affected system. The CVSS 4.0 base score is 6.9 (medium), reflecting network attack vector, no privileges required, no user interaction, and low to limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing compensating controls such as restricting access to the affected endpoint, applying network-level protections, or disabling the vulnerable component until a patch is available.