What is the CVSS score of CVE-2026-38934?

CVE-2026-38934 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of diskover-community are affected by CVE-2026-38934?

diskover-community versions 2.3.5 and earlier contain a cross-site request forgery vulnerability enabling privilege escalation and unauthorized exposure of sensitive configuration data.

How to fix or mitigate CVE-2026-38934?

Within 24 hours, identify all systems running diskover-community 2.3.5 or earlier and restrict public/settings_process.php access to authenticated internal networks only via firewall rules. Within 7 days, deploy web application firewall (WAF) rules to block requests missing CSRF tokens, and conduct security awareness training for administrative users on social engineering and CSRF attack vectors. Within 30 days, monitor diskover project repositories and security advisories for patch availability; prepare and test an upgrade plan to versions post-2.3.5 when vendor patches are released.

diskover-community CVE-2026-38934

EUVD-2026-25889 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-27 cve@mitre.org

PHP CSRF

8.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Classic CSRF: PR:N as attacker holds no credentials but UI:R since a logged-in victim must trigger the request; settings tampering plus info disclosure yields high C/I/A, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:59 vuln.today

CVSS changed

Apr 27, 2026 - 18:22 NVD

8.8 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 17:22 euvd

EUVD-2026-25889

CVE Published

Apr 27, 2026 - 17:16 nvd

HIGH 8.8

DescriptionCVE.org

Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sensitive information via the public/settings_process.php

AnalysisAI

Cross-site request forgery in diskover-community (diskover) version 2.3.5 and earlier lets a remote attacker forge state-changing requests to public/settings_process.php, escalating privileges and exposing sensitive configuration data when an authenticated user is lured into triggering the request. The flaw carries a CVSS 8.8 rating and total technical impact per CISA SSVC, though publicly available exploit code exists rather than confirmed active exploitation, and the EPSS probability is very low (0.02%).

Technical ContextAI

diskover is an open-source file-system indexing and storage-analytics web application with a PHP front end (confirmed by the 'PHP' tag) that fronts an Elasticsearch backend. The vulnerable endpoint, public/settings_process.php, is the server-side handler that applies configuration/settings changes. The root cause is CWE-352 (Cross-Site Request Forgery): the handler acts on incoming requests without verifying an anti-CSRF token or validating request origin, so a request carrying the victim's authenticated session cookie is honored regardless of whether the victim intended it. Because settings processing can alter privilege-relevant configuration and reveal sensitive information, a forged request translates directly into privilege escalation and information disclosure.

RemediationAI

No vendor-released patch version is identified in the available data, and the EUVD 'n/a' version fields do not confirm a fixed release - monitor the vendor at http://diskover-community.com and http://diskoverdata.com for an update newer than 2.3.5 and upgrade as soon as one is published. As specific compensating controls until a fix exists: place diskover behind an authenticating reverse proxy and restrict access to public/settings_process.php to trusted admin source IPs (trade-off: breaks legitimate remote admins not on the allowlist); enforce SameSite=Strict (or Lax) on the diskover session cookie to block cross-origin cookie attachment (trade-off: minimal, may affect legitimate cross-site links); and require admins to log out of diskover when not actively using it and avoid browsing other sites in the same session (trade-off: operational friction only). Consult the third-party write-up at https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38934 for exploit specifics when validating mitigations.