CVE-2025-56798

Deferred Deferred - Pending Action

CSRF in Unraid OS via Authentication Cookie

Publication date: 2026-08-26

Last updated on: 2026-09-09

Assigner: MITRE

Description

Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-09

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2025-56798

EUVD

EUVD-2025-210782

Affected Vendors & Products

Vendor	Product	Version / Range
lime_technology	unraid_os	to 6.12.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in Unraid OS versions 6.12.14 and earlier. It allows remote attackers to escalate privileges by exploiting the authentication cookie's lax same-site policy, potentially enabling session hijacking and unauthorized actions.

Detection Guidance

To detect this CSRF vulnerability, check if your Unraid OS version is 6.12.14 or earlier. Verify the same-site policy of the Unraid authentication cookie by inspecting network traffic or browser developer tools for cookie attributes. Look for the 'SameSite' attribute set to 'Lax' or missing entirely.

Impact Analysis

An attacker could trick an authenticated user into clicking a malicious link, leading to session hijacking or privilege escalation. This may result in unauthorized access to the Unraid server, allowing code execution, data theft, or control over containers and virtual machines.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Compliance may be compromised due to potential exposure of sensitive data and lack of proper session security.

Mitigation Strategies

Immediately upgrade to Unraid OS version 6.12.15 or 7.0.0 to address the CSRF vulnerability. If upgrading is not possible, install the Unraid Patch Plugin to mitigate related XSS vulnerabilities and ensure session cookies use the 'Strict' same-site policy.

Hi! I’m here to help you understand CVE-2025-56798. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70