Webasyst Framework EUVD-2026-109803

Exploitation requires that the victim be a Photos app backend user with an active authenticated session, and that the Photos app not enable the framework's opt-in CSRF check - which per the description is the default state through version 4.4.0, so no non-default configuration is needed on the target side. The attacker must deliver a malicious page and induce the logged-in user to load it (UI:P / social engineering), and the forged actions are limited to the specific backend endpoints photo/delete, album/save, photo/manageAccessSave, and photo/saveField. Key limiting factors: the required authenticated-victim interaction prevents unattended/automated mass exploitation, and impact is confined to photo deletion and access-rights changes within the Photos app (no confidentiality or system-level impact).

This is a moderate, not emergency, priority. The CVSS 4.0 base score of 7.1 reflects a CSRF flaw (CWE-352) with network vector (AV:N), low complexity (AC:L), no attacker privileges (PR:N), but required user interaction (UI:P) and only integrity impact (VI:H; VC:N/VA:N). The scoped impact is narrow: forged backend actions in the Photos app (deleting photos, altering album access rights), not code execution or data disclosure. The vuln.today decision label is 'this_week', consistent with a real-but-not-critical issue. No EPSS score is provided in the input, and there is no CISA KEV listing, so there is no evidence of active exploitation - treat the absence of EPSS as a data gap, not as low probability. The practical risk ceiling is set by the UI:P requirement: an attacker must lure an already-authenticated Photos backend user to a malicious page, which limits mass automatability and makes this better suited to targeted social engineering than opportunistic scanning. Overall this is a legitimate but bounded web-app risk whose severity is driven by ease of forging requests, tempered by the need for an authenticated victim and attacker-controlled lure.

An attacker crafts a web page containing auto-submitting forms (or hidden requests) that POST to the Photos app's photo/delete, album/save, photo/manageAccessSave, or photo/saveField endpoints, then lures a currently-logged-in Photos backend user to visit it. Because the Photos app does not enable the framework's opt-in CSRF check, the victim's browser submits the forged requests with their valid session, deleting photos or changing access rights without the victim's intent. No public exploit code is identified at time of analysis, though VulnCheck's advisory and GitHub issue #393 document the flaw and the affected endpoints.