CVE-2026-22800

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22800", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-09T22:50:10.287Z", "datePublished": "2026-01-12T22:09:56.779Z", "dateUpdated": "2026-01-13T19:08:05.046Z"}, "containers": {"cna": {"title": "PILOS affected by a CSRF via GET request allows unintentional termination of all active video conferences", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/THM-Health/PILOS/security/advisories/GHSA-r24c-9p4j-rqw9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/THM-Health/PILOS/security/advisories/GHSA-r24c-9p4j-rqw9"}, {"name": "https://github.com/THM-Health/PILOS/commit/d9ab9bb7ac0a8581c25e24cb7db2152d40be4d1b", "tags": ["x_refsource_MISC"], "url": "https://github.com/THM-Health/PILOS/commit/d9ab9bb7ac0a8581c25e24cb7db2152d40be4d1b"}], "affected": [{"vendor": "THM-Health", "product": "PILOS", "versions": [{"version": "< 4.10.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T22:09:56.779Z"}, "descriptions": [{"lang": "en", "value": "PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery (CSRF) vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs a destructive action but is exposed via an HTTP GET request. Although proper authorization checks are enforced and the endpoint cannot be triggered cross-site, the use of GET allows the action to be implicitly invoked through same-site content (e.g. embedded resources rendered within the application). As a result, an authenticated administrator who views crafted content within the application may unknowingly trigger the endpoint, causing all active video conferences on the server to be terminated without explicit intent or confirmation. This vulnerability is fixed in 4.10.0."}], "source": {"advisory": "GHSA-r24c-9p4j-rqw9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T14:14:04.864529Z", "id": "CVE-2026-22800", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T19:08:05.046Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22800", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T14:14:04.864529Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T14:14:08.035Z"}}], "cna": {"title": "PILOS affected by a CSRF via GET request allows unintentional termination of all active video conferences", "source": {"advisory": "GHSA-r24c-9p4j-rqw9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "THM-Health", "product": "PILOS", "versions": [{"status": "affected", "version": "< 4.10.0"}]}], "references": [{"url": "https://github.com/THM-Health/PILOS/security/advisories/GHSA-r24c-9p4j-rqw9", "name": "https://github.com/THM-Health/PILOS/security/advisories/GHSA-r24c-9p4j-rqw9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/THM-Health/PILOS/commit/d9ab9bb7ac0a8581c25e24cb7db2152d40be4d1b", "name": "https://github.com/THM-Health/PILOS/commit/d9ab9bb7ac0a8581c25e24cb7db2152d40be4d1b", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery (CSRF) vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs a destructive action but is exposed via an HTTP GET request. Although proper authorization checks are enforced and the endpoint cannot be triggered cross-site, the use of GET allows the action to be implicitly invoked through same-site content (e.g. embedded resources rendered within the application). As a result, an authenticated administrator who views crafted content within the application may unknowingly trigger the endpoint, causing all active video conferences on the server to be terminated without explicit intent or confirmation. This vulnerability is fixed in 4.10.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T22:09:56.779Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22800", "state": "PUBLISHED", "dateUpdated": "2026-01-13T19:08:05.046Z", "dateReserved": "2026-01-09T22:50:10.287Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-12T22:09:56.779Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "PILOS", "vendor": "THM-Health", "versions": [{"status": "affected", "version": "< 4.10.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:thm:pilos:*:*:*:*:*:*:*:*", "matchCriteriaId": "22DA1502-AFE6-4A80-B427-161C9B7726EB", "versionEndExcluding": "4.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery (CSRF) vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs a destructive action but is exposed via an HTTP GET request. Although proper authorization checks are enforced and the endpoint cannot be triggered cross-site, the use of GET allows the action to be implicitly invoked through same-site content (e.g. embedded resources rendered within the application). As a result, an authenticated administrator who views crafted content within the application may unknowingly trigger the endpoint, causing all active video conferences on the server to be terminated without explicit intent or confirmation. This vulnerability is fixed in 4.10.0."}, {"lang": "es", "value": "PILOS (Plataforma para Seminarios Interactivos en Vivo en L\u00ednea) es un frontend para BigBlueButton. Antes de la versi\u00f3n 4.10.0, existe una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en un endpoint de API administrativo responsable de terminar todas las videoconferencias activas en un \u00fanico servidor. El endpoint afectado realiza una acci\u00f3n destructiva pero est\u00e1 expuesto a trav\u00e9s de una petici\u00f3n HTTP GET. Aunque se aplican comprobaciones de autorizaci\u00f3n adecuadas y el endpoint no puede ser activado de forma cruzada, el uso de GET permite que la acci\u00f3n sea invocada impl\u00edcitamente a trav\u00e9s de contenido del mismo sitio (por ejemplo, recursos incrustados renderizados dentro de la aplicaci\u00f3n). Como resultado, un administrador autenticado que visualice contenido malicioso dentro de la aplicaci\u00f3n podr\u00eda activar el endpoint sin saberlo, provocando que todas las videoconferencias activas en el servidor sean terminadas sin intenci\u00f3n expl\u00edcita o confirmaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 4.10.0."}], "id": "CVE-2026-22800", "lastModified": "2026-06-17T10:20:27.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22800", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T14:14:04.864529Z", "version": "2.0.3"}}]}, "published": "2026-01-12T23:15:52.747", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/THM-Health/PILOS/commit/d9ab9bb7ac0a8581c25e24cb7db2152d40be4d1b"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/THM-Health/PILOS/security/advisories/GHSA-r24c-9p4j-rqw9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:27:04.498993+00:00", "value": {"mitigation_remediation": ["Apply the official patch to update PILOS to version 4.10.0 or later.", "Ensure the termination endpoint uses a non\u2011GET method and requires a CSRF token\u2014modify the server\u2011side code or configuration to enforce POST/DELETE and validate anti\u2011CSRF tokens.", "Restrict the loading of external or embedded content in the admin interface to prevent same\u2011site requests that could unintentionally trigger the endpoint (e.g., disable iframes or external script loading within admin pages)."], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The flaw exists in THM\u2011Health PILOS versions earlier than 4.10.0, which are used as frontends for BigBlueButton. Administrators with authenticated access to the application can potentially trigger the endpoint by viewing crafted content that invokes the GET URL within the application context.", "description_and_impact": "A CSRF vulnerability in the administrative API of the PILOS platform allows the deletion of all active video conferences when the endpoint is invoked via an HTTP GET request. Because the performed action is destructive, any accidental or malicious trigger can suspend all ongoing meetings, leading to a significant disruption of service availability. The weakness is identified as a request forgery flaw (CWE-352).", "risk_and_exploitability": "The CVSS score is 2.4, indicating a low severity. The EPSS score is below 1\u202f%, suggesting a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need an authenticated administrator to view crafted content within the same site, which would trigger the same\u2011site GET request to the termination endpoint. The endpoint is protected against cross\u2011site requests and requires administrative access, so the attack relies on a single administrator session. The impact is limited to the server\u2019s active conferences; however, terminating all meetings simultaneously can disrupt service."}}}}, "created": "2026-01-13T09:27:20.232990+00:00", "updated": "2026-04-18T16:30:05.088552+00:00", "vendors": ["thm", "thm$PRODUCT$pilos"]}