CVE-2026-22800

{
  "id": "CVE-2026-22800",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-22800",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-13T14:14:04.864529Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 2.4,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 0.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "THM-Health",
          "product": "PILOS",
          "versions": [
            {
              "status": "affected",
              "version": "< 4.10.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-12T23:15:52.747",
  "references": [
    {
      "url": "https://github.com/THM-Health/PILOS/commit/d9ab9bb7ac0a8581c25e24cb7db2152d40be4d1b",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/THM-Health/PILOS/security/advisories/GHSA-r24c-9p4j-rqw9",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery (CSRF) vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs a destructive action but is exposed via an HTTP GET request. Although proper authorization checks are enforced and the endpoint cannot be triggered cross-site, the use of GET allows the action to be implicitly invoked through same-site content (e.g. embedded resources rendered within the application). As a result, an authenticated administrator who views crafted content within the application may unknowingly trigger the endpoint, causing all active video conferences on the server to be terminated without explicit intent or confirmation. This vulnerability is fixed in 4.10.0."
    },
    {
      "lang": "es",
      "value": "PILOS (Plataforma para Seminarios Interactivos en Vivo en Línea) es un frontend para BigBlueButton. Antes de la versión 4.10.0, existe una vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en un endpoint de API administrativo responsable de terminar todas las videoconferencias activas en un único servidor. El endpoint afectado realiza una acción destructiva pero está expuesto a través de una petición HTTP GET. Aunque se aplican comprobaciones de autorización adecuadas y el endpoint no puede ser activado de forma cruzada, el uso de GET permite que la acción sea invocada implícitamente a través de contenido del mismo sitio (por ejemplo, recursos incrustados renderizados dentro de la aplicación). Como resultado, un administrador autenticado que visualice contenido malicioso dentro de la aplicación podría activar el endpoint sin saberlo, provocando que todas las videoconferencias activas en el servidor sean terminadas sin intención explícita o confirmación. Esta vulnerabilidad está corregida en la versión 4.10.0."
    }
  ],
  "lastModified": "2026-06-17T10:20:27.217",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:thm:pilos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22DA1502-AFE6-4A80-B427-161C9B7726EB",
              "versionEndExcluding": "4.10.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}