Drug Recommendation System EUVD-2026-92947

Exploitation requires an authenticated victim with an active session in the Drug Recommendation System to be lured into visiting attacker-controlled content while logged in (UI:P), because the affected state-changing request lacks anti-CSRF tokens (CWE-352). The attacker needs no credentials of their own (PR:N) and the request travels over the network (AV:N), but success is limited by the need for victim interaction, a valid victim session, and the fact that only limited integrity is affected - no data disclosure or denial of service results. The specific endpoint is not named in the advisory, so defenders must audit all state-changing forms for missing token validation.

This is a low-to-moderate real-world risk despite being remotely reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) describes an unauthenticated, network-reachable CSRF flaw that requires passive user interaction and yields only limited integrity impact (VI:L) with no confidentiality or availability impact - consistent with the 5.3 medium score. Publicly available exploit code exists (E:P and a GitHub PoC reference), which raises accessibility, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The dependence on tricking an authenticated victim into visiting a malicious page (UI:P) and the narrow impact mean this is a genuine but not high-priority issue - more relevant for defense-in-depth hardening than emergency patching. Key missing signals: no EPSS probability and no KEV data were supplied, so exploitation likelihood cannot be quantified; treat the PoC as a proof of feasibility, not evidence of in-the-wild use.

An attacker hosts a malicious web page containing a hidden auto-submitting form targeting a state-changing endpoint of the Drug Recommendation System. When an authenticated user (e.g., a logged-in administrator) visits the page, their browser silently submits the forged request using their session, performing an unwanted action without their consent. A public proof-of-concept documenting the missing anti-CSRF tokens is available on GitHub, lowering the barrier to reproduction.