LinkStack EUVD-2026-109390

Exploitation requires a victim who is authenticated to the LinkStack instance (version up to 4.8.8) and who, while that session is active, is tricked into interacting with attacker-controlled content - matching the vector's UI:P (passive user interaction). The attacker needs no credentials or privileges of their own (PR:N) and the request is delivered remotely over the network (AV:N). Limiting factors: the attack fails without an active authenticated victim session and without the required user interaction, the impact is confined to a low integrity effect (VC:N/VA:N, VI:L), and the exact vulnerable function/endpoint is not described in the available sources. Standard anti-CSRF defenses (token validation, SameSite cookies) would also prevent it where present.

All quantitative signals point to a moderate, non-urgent issue. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) scores 5.3 and is internally consistent with a classic CSRF: network-reachable, low complexity, no attacker privileges, but requiring victim user interaction (UI:P) and yielding only low integrity impact with zero confidentiality or availability impact. No EPSS probability was provided, the CVE is not on CISA KEV, and no public exploit was identified in the supplied references, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' (not act_now or emergency), which aligns with the low-to-moderate severity rather than overriding it. The one caveat is sourcing: this is a single-source VulDB disclosure with no vendor acknowledgement, so the affected-version boundary and the precise vulnerable function are unverified. Net assessment: a genuine but low-priority integrity-only CSRF, not a high-CVSS-but-overrated item nor a drop-everything emergency.

An attacker crafts a malicious web page or link containing an auto-submitting request to a LinkStack (up to 4.8.8) endpoint and lures a currently authenticated LinkStack user into visiting it. Because the request rides the victim's existing session, the application performs an unintended state-changing action on the victim's behalf. No public proof-of-concept exploit was identified in the provided data, and success depends on the victim being logged in and interacting with the attacker's content (UI:P).