CVE-2026-38934

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-38934", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-07-05T16:15:30.097Z", "dateReserved": "2026-04-06T00:00:00.000Z", "datePublished": "2026-04-27T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-07-05T16:15:30.097Z"}, "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sensitive information via the public/settings_process.php"}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38934"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-352", "lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "references": [{"url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38934", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T17:48:23.590060Z", "id": "CVE-2026-38934", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T17:48:28.489Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-38934", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-27T17:48:23.590060Z"}}}], "references": [{"url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38934", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T17:48:15.785Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "http://diskover-community.com"}, {"url": "http://diskoverdata.com"}, {"url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38934"}], "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sensitive information via the public/settings_process.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-27T17:04:59.053Z"}}}, "cveMetadata": {"cveId": "CVE-2026-38934", "state": "PUBLISHED", "dateUpdated": "2026-04-27T17:48:28.489Z", "dateReserved": "2026-04-06T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-27T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sensitive information via the public/settings_process.php"}], "id": "CVE-2026-38934", "lastModified": "2026-07-05T17:17:33.917", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-38934", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T17:48:23.590060Z", "version": "2.0.3"}}]}, "published": "2026-04-27T17:16:43.037", "references": [{"source": "cve@mitre.org", "url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38934"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38934"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.3.5]"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "inferred"}, {"score": 81.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "diskover", "vendor": "diskoverdata"}], "analysis": {"en": {"generated_at": "2026-04-28T23:33:05.134050+00:00", "value": {"mitigation_remediation": ["Upgrade diskover-community to the latest release that removes the CSRF bug in public/settings_process.php.", "If an upgrade cannot be performed immediately, restrict access to public/settings_process.php so that only authenticated users or known IP ranges can reach the endpoint, for example by configuring web\u2011server ACLs or a firewall rule.", "Enforce CSRF protection on settings_update operations by requiring a unique token in POST requests, which prevents forged requests from succeeding unless the user\u2019s session contains a valid token."], "summary": {"action": "Patch Immediately", "impact": "Privilege Escalation and Information Disclosure"}, "threat_synthesis": {"affected_systems": "All installations of the Diskover\u2011Data community edition are affected. Any instance running version 2.3.5 or earlier is vulnerable; newer releases are not known to be affected.", "description_and_impact": "Diskover\u2011Community versions 2.3.5 and earlier contain a Cross\u2011Site Request Forgery flaw in the file public/settings_process.php. A remote attacker can send forged HTTP requests that the application accepts as legitimate, allowing the attacker to elevate privileges within the application and read or modify sensitive data. This vulnerability is classified as CWE\u2011352 and represents a severe flaw in state\u2011management and request validation.", "risk_and_exploitability": "The flaw scores 8.8 on CVSS, indicating high severity. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is public and does not require prior authentication; a malicious actor can craft a forged request via a victim\u2019s browser or a hidden form submitted to public/settings_process.php from a compromised third\u2011party site. Due to the simplicity of the CSRF payload and the lack of additional access controls, the risk of exploitation remains significant."}}}}, "created": "2026-04-28T05:00:14.756265+00:00", "updated": "2026-04-28T23:45:16.047090+00:00", "vendors": ["diskoverdata", "diskoverdata$PRODUCT$diskover"]}