CVE-2026-107831

Received Received - Intake

Cross-Site Request Forgery in Jivejdon

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: VulnCheck

Description

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll, /account/protected/sub/delSub, or /message/updateAction to delete private messages and subscriptions or rename threads.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-107831

Affected Vendors & Products

Vendor	Product	Version / Range
banq	jivejdon	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site request forgery (CSRF) flaw in Jivejdon version 5.0. It allows attackers to trick authenticated users into performing unwanted actions via crafted links. The issue occurs because GET endpoints lack anti-CSRF tokens, enabling attackers to delete private messages, subscriptions, or rename threads by luring users to malicious links targeting specific endpoints.

Detection Guidance

Detecting this CSRF vulnerability requires checking if GET endpoints like /account/protected/delAll, /account/protected/sub/delSub, or /message/updateAction lack anti-CSRF tokens. Monitor network traffic for unauthorized state-changing requests from authenticated users.

Impact Analysis

If you use Jivejdon 5.0, an attacker could exploit this to delete your private messages or subscriptions without your consent. They could also rename threads you are involved in. This requires you to click a malicious link while logged into the application.

Compliance Impact

This vulnerability could lead to unauthorized data deletion or modification, potentially violating GDPR's integrity principle or HIPAA's access controls. Organizations using Jivejdon 5.0 may face compliance risks if user data is compromised due to this flaw.

Mitigation Strategies

Immediately update Jivejdon to the latest version. Ensure all state-changing endpoints use POST requests with anti-CSRF tokens. Validate and sanitize all user inputs to prevent CSRF attacks.

Hi! I’m here to help you understand CVE-2026-107831. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70