EUVD-2026-40323
GHSA-w423-2pcr-p665
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:N and AV:N reflect no attacker privileges; I:H captures full account takeover via credential change; UI:R mandates victim interaction.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
KTM System e-BOK is vulnerable to Cross‑Site Request Forgery (CSRF) in both the email-change and password-change functionalities. An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged POST request to the application. This allows the attacker to trigger an unauthorized email or password change on behalf of the victim without their knowledge or interaction.
This issue was fixed in the patch published in June 2026.
AnalysisAI
CSRF flaws in KTM System e-BOK's email-change and password-change endpoints allow any remote, unauthenticated attacker to trigger account credential changes on behalf of an authenticated victim by luring them to a malicious web page. Reported by CERT-PL, the vulnerabilities affect all e-BOK versions prior to the June 2026 patch and carry a CVSS 4.0 score of 5.1 (Medium). No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially constructable given the well-understood CSRF class and the public CERT-PL advisory.
Technical ContextAI
KTM System e-BOK ('internetowe biuro obsługi klienta' - Electronic Customer Service Office) is a Polish-market web-based self-service customer portal produced by KTM System (ktmsystem.pl). The root cause is CWE-352 (Cross-Site Request Forgery): the application's email-change and password-change POST endpoints do not validate that requests originate from the legitimate application context - there is no CSRF synchronizer token, double-submit cookie, or equivalent anti-forgery mechanism. Because browsers automatically attach session cookies to cross-origin POST requests (unless cookies are flagged SameSite=Strict or SameSite=Lax in contexts that block cross-site POSTs), an attacker-controlled page can silently issue forged requests that the server accepts as legitimate. The affected CPE cpe:2.3:a:ktm_system:e-bok:*:*:*:*:*:*:*:* covers all versions of the product without version bounds, indicating the flaw predates the June 2026 patch.
RemediationAI
Apply the patch published by KTM System in June 2026, which resolves the CSRF vulnerabilities in both the email-change and password-change functionalities. Contact KTM System via the product page at https://ktmsystem.pl/internetowe-biuro-obslugi-klienta/ for the exact patched release and update procedures; the CERT-PL advisory at https://cert.pl/posts/2026/06/CVE-2026-35095/ may provide additional detail. An exact patched version number was not independently confirmed from available input data, so operators should verify the installed build directly with the vendor. If immediate patching is not feasible, a targeted compensating control is to configure a web application firewall or reverse proxy to enforce Origin and Referer header validation on POST requests to the email-change and password-change endpoints, rejecting any request whose Origin or Referer does not match the application's own domain - this blocks cross-site forged requests but may produce false positives for users on privacy-hardening browsers that strip referrer headers, so monitor for legitimate user impact. Additionally, encouraging users to log out of e-BOK sessions when not actively in use reduces the window of opportunity for CSRF exploitation.
Unlimited brute-force attacks against KTM System e-BOK user accounts are enabled by the complete absence of login rate l
KTM System e-BOK enforces a system-wide password policy that restricts all user credentials to exactly six numeric digit
Session fixation in KTM System e-BOK (an online customer service portal) enables an attacker to preset a session identif
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today