EUVD-2026-37883
GHSA-f336-f4qw-pgx2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered CSRF needs no attacker credentials (PR:N) but requires the victim to click/load attacker content (UI:R); impact assumes a privileged victim, giving C:H/I:H and limited A:L.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
uBB.threads is vulnerable to a Cross-Site Request Forgery (CSRF) due to a lack of protective mechanisms. This allows an attacker to trick an authenticated user into executing unintended actions.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.
AnalysisAI
Cross-site request forgery in UBB.threads forum software version 7.7.5 (and potentially earlier versions) allows remote attackers to coerce authenticated forum users - including administrators - into executing unintended state-changing actions by visiting an attacker-controlled page. The flaw was reported by CERT-PL after unsuccessful vendor contact, so no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must be currently authenticated to a UBB.threads 7.7.5 forum in the same browser session that opens the attacker-controlled page (UI:A - active user interaction required: clicking a link, viewing an attacker-controlled page, or opening an HTML email). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L yields 8.6, which is driven by the assumption that the victim is a high-privilege user (admin) whose hijacked session can fully compromise the forum's confidentiality and integrity; against a low-privilege member the practical impact is much lower, so this is best treated as a 'severity depends on victim privilege' issue rather than a uniform 8.6 across all users. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a forum running UBB.threads 7.7.5 and crafts a webpage containing an auto-submitting form (or image/fetch) targeting a privileged endpoint such as 'promote user to admin' or 'delete board'. They send the URL to a forum administrator via direct message, email or a poisoned external link; when the admin - already logged into the forum in the same browser - opens the page, their browser silently submits the request with valid session cookies, and the action executes with the admin's privileges. … |
| Remediation | No vendor-released patch identified at time of analysis, as CERT-PL reports vendor contact attempts were unsuccessful - operators should monitor https://www.ubbcentral.com/ for a forthcoming release and the CERT-PL advisory at https://cert.pl/en/posts/2026/06/CVE-2026-54219 for updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all UBB.threads 7.7.5 instances in your environment and restrict forum access to internal networks only if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ubb Threads
View allCross-site scripting (XSS) vulnerability in forums/ubbthreads.php in UBB.threads 7.5.6 and earlier allows remote attacke
Remote code execution in UBB.threads forum software (version 7.7.5 confirmed) is achievable by authenticated users holdi
Authenticated blind SQL injection in UBB.threads forum software version 7.7.5 (and likely other versions) allows adminis
Database-resource exhaustion in UBB.threads forum software (confirmed in version 7.7.5) allows an authenticated low-priv
Reflected XSS in UBB.threads 7.7.5 enables remote attackers to execute arbitrary JavaScript in a victim's browser by tri
Stored XSS in UBB.threads 7.7.5 permits low-privileged forum members to permanently inject arbitrary JavaScript into pos
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today