Turms Admin API CVE-2025-66906

Exploitation requires an authenticated Turms administrator to have a live session to the Admin API AND to be socially engineered into visiting an attacker-controlled page or clicking a crafted link that issues the forged request (UI:R). It is bounded to deployments running Turms up to v0.10.0-SNAPSHOT where the Admin API lacks anti-CSRF protections (e.g., CSRF tokens, SameSite cookies, or origin validation). The attacker needs no credentials of their own (PR:N), but cannot succeed without the victim admin's active session and interaction, which meaningfully narrows real-world risk versus the network vector alone.

This is a moderate-severity CSRF (CWE-352) in the Turms Admin API, carrying a vendor/NVD CVSS 3.1 base of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The network attack vector and low complexity favor the attacker, and the scope change (S:C) reflects that a successful forgery against an authenticated admin yields escalated privileges in the admin plane. However, the defining limiter is UI:R: exploitation is NOT self-propelling - it requires a logged-in Turms administrator to be lured into triggering an attacker-crafted request. There is no EPSS score, no SSVC decision data, and no KEV listing in the provided input, so the only positive exploitation signal is a publicly available PoC/write-up. Net assessment: publicly available exploit code exists, but there is no evidence of active exploitation; combined with the niche footprint of Turms, this reads as a real-but-not-urgent issue - prioritize patching for anyone actually running the affected SNAPSHOT build, but it does not rise to emergency status. Note the C:L/I:L rating may understate impact: 'gain escalated privileges' on an admin API could plausibly warrant higher integrity impact - verify the concrete privilege outcome against the referenced PoC report.

An attacker hosts a malicious page or sends a link to a Turms administrator who has an active authenticated session to the Admin API. When the admin visits the page, their browser is forced to submit a forged state-changing request to the Admin API, granting the attacker-controlled account (or the victim's own session) escalated privileges. A public PoC/write-up for this flaw is already available, lowering the barrier to reproduction.