FluxCP CVE-2025-62797

Exploitation requires that the victim be an actively authenticated FluxCP user (valid session cookie) AND be lured into loading attacker-controlled web content (UI:P) that issues a cross-origin POST to a vulnerable state-changing endpoint. The root enabling condition is that FluxCP's state-changing POST handlers authorize requests using only the session cookie, with no per-request anti-CSRF token and no robust Origin/Referer validation. Limiting factors that reduce realistic risk: the attacker cannot act without a logged-in victim's participation, the target FluxCP instance must be reachable by that victim's browser, and the fix mitigates the class by setting SameSite=Strict (plus HttpOnly/Secure) cookies - so modern browsers on patched or SameSite-defaulting configurations substantially blunt cross-site cookie submission.

This is a CWE-352 Cross-Site Request Forgery flaw in FluxCP, with a vendor (GitHub Security Advisory) CVSS 4.0 score of 8.6 (High). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) indicates network reachability, low attack complexity, and no attacker-side privileges, but crucially requires passive user interaction (UI:P) - a logged-in victim must be lured to an attacker-controlled page, which is the defining and limiting characteristic of CSRF. Impact is high to confidentiality and integrity (VC:H/VI:H) with no availability impact (VA:N) and no scope/subsequent-system change. Contrasting signals: EPSS is very low at 0.20% (9th percentile), the vulnerability is NOT in CISA KEV, and no public exploit code was identified, so despite the high CVSS this is not an actively-exploited, mass-scanned priority. The high score is driven largely by CVSS 4.0's treatment of unauthenticated network vector plus high C/I impact, but real-world exploitation is gated by needing a victim who is both authenticated to a specific FluxCP instance and tricked into visiting a malicious page. Net: a genuine, patchable security weakness that operators of affected FluxCP sites should fix, but the combination of low EPSS, no KEV, no POC, required user interaction, and a niche product footprint makes it a moderate rather than urgent widespread risk.

An attacker crafts a malicious web page (or email link) containing an auto-submitting form targeting a state-changing POST endpoint of a FluxCP site. When a currently logged-in FluxCP user visits that page, their browser submits the request with their valid session cookie, causing a sensitive account action to execute without their consent. No public exploit code was identified at time of analysis, though CSRF proof-of-concepts of this type are trivial to construct.