What is the CVSS score of CVE-2026-22800?

CVE-2026-22800 has a CVSS 3.1 base score of 2.4 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Pilos are affected by CVE-2026-22800?

CVE-2026-22800 is a low-severity vulnerability involving CSRF (CVSS 2.4). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

How to fix or mitigate CVE-2026-22800?

During next maintenance window: Apply vendor patches when convenient. Verify CSRF controls are in place.

Pilos CVE-2026-22800

LOW

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-01-12 security-advisories@github.com

CSRF Pilos

2.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.4 LOW

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Jan 21, 2026 - 18:42 nvd

Patch available

CVE Published

Jan 12, 2026 - 23:15 nvd

LOW 2.4

DescriptionGitHub Advisory

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery (CSRF) vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs a destructive action but is exposed via an HTTP GET request. Although proper authorization checks are enforced and the endpoint cannot be triggered cross-site, the use of GET allows the action to be implicitly invoked through same-site content (e.g. embedded resources rendered within the application). As a result, an authenticated administrator who views crafted content within the application may unknowingly trigger the endpoint, causing all active video conferences on the server to be terminated without explicit intent or confirmation. This vulnerability is fixed in 4.10.0.

AnalysisAI

Technical ContextAI

Classified as CWE-352 (Cross-Site Request Forgery (CSRF)). Affects the an administrative API component of Pilos. PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery (CSRF) vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs a destructive action but is exposed via an HTTP GET request. Although proper authorization checks are enforced and the endpoint cannot be triggered cross-site, the use of GET allows the action to be