Phoca Download CVE-2026-102787

Exploitation requires a logged-in Joomla administrator (or user with Phoca Download category-management privileges) to be tricked into visiting attacker-controlled content while their session is active (UI:P), because the affected category-management functions lack adequate anti-CSRF token validation. Affected deployments are Phoca Download versions 3.1.0 through 6.1.5. Limiting factors: the victim must have an active privileged session, must perform the interaction, and the forged action is confined to category management (limited integrity/availability impact, no confidentiality disclosure) - the remote attacker cannot act without the victim's authenticated browser.

This is a moderate, low-priority issue rather than an emergency. The CVSS 4.0 base score is 5.3 with vector AV:N/AC:L/AT:N/PR:N/UI:P and only limited integrity and availability impact (VI:L/VA:L, VC:N) - a classic CSRF (CWE-352) profile where the attacker needs no credentials but a privileged victim must be tricked into acting (UI:P). EPSS is low at 0.21% (12th percentile), the vulnerability is NOT in CISA KEV, and no exploit code or PoC reference is present in the input (references point only to the vendor homepage and the NVD advisory). All signals align downward: the vuln.today Decision label is 'this_month' (routine patching, not act_now/emergency), consistent with low EPSS and no known exploitation. The one nuance to flag: PR:N reflects that the remote attacker needs no privileges, but CSRF inherently depends on a logged-in, privileged administrator being socially engineered into triggering the forged request - so real-world exploitation is gated by victim interaction and an active admin session, not raw remote reachability. No key signals conflict; the data consistently indicates a genuine but non-urgent, low-probability issue.

An attacker crafts a malicious web page or email link that silently submits a forged category-management request to a Joomla site running Phoca Download. If a logged-in administrator visits that page while their session is active, the browser sends the request with their cookies, causing unwanted category changes (creation, modification, or deletion). No public exploit code was identified at time of analysis, and success depends on the admin interacting with attacker-controlled content.