{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-38934", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-27T17:48:28.489Z", "dateReserved": "2026-04-06T00:00:00.000Z", "datePublished": "2026-04-27T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-27T17:04:59.053Z"}, "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sensitive information via the public/settings_process.php"}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "http://diskover-community.com"}, {"url": "http://diskoverdata.com"}, {"url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38934"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-352", "lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "references": [{"url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38934", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T17:48:23.590060Z", "id": "CVE-2026-38934", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T17:48:28.489Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-38934", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-27T17:48:23.590060Z"}}}], "references": [{"url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38934", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T17:48:15.785Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "http://diskover-community.com"}, {"url": "http://diskoverdata.com"}, {"url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38934"}], "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sensitive information via the public/settings_process.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-27T17:04:59.053Z"}}}, "cveMetadata": {"cveId": "CVE-2026-38934", "state": "PUBLISHED", "dateUpdated": "2026-04-27T17:48:28.489Z", "dateReserved": "2026-04-06T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-27T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sensitive information via the public/settings_process.php"}], "id": "CVE-2026-38934", "lastModified": "2026-04-27T18:35:53.583", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-04-27T17:16:43.037", "references": [{"source": "cve@mitre.org", "url": "http://diskover-community.com"}, {"source": "cve@mitre.org", "url": "http://diskoverdata.com"}, {"source": "cve@mitre.org", "url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38934"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38934"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.3.5]"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "inferred"}, {"score": 81.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "diskover", "vendor": "diskoverdata"}], "analysis": {"en": {"generated_at": "2026-04-28T04:59:58.543672+00:00", "value": {"mitigation_remediation": ["Upgrade diskover-community to the latest release that removes the CSRF bug in public/settings_process.php.", "If an upgrade cannot be performed immediately, restrict access to public/settings_process.php so that only authenticated users or known IP ranges can reach the endpoint, for example by configuring web\u2011server ACLs or a firewall rule.", "Enforce CSRF protection on settings_update operations by requiring a unique token in POST requests, which prevents forged requests from succeeding unless the user\u2019s session contains a valid token."], "summary": {"action": "Patch Immediately", "impact": "Privilege Escalation and Information Disclosure"}, "threat_synthesis": {"affected_systems": "All installations of the Diskover\u2011Data community edition are affected. Any instance running version 2.3.5 or earlier is vulnerable; no later release is known to be vulnerable.", "description_and_impact": "Diskover\u2011Community versions 2.3.5 and earlier contain a Cross\u2011Site Request Forgery flaw in public/settings_process.php that allows a remote attacker to send forged requests which the application accepts as legitimate. The attacker can thus raise privileges within the application and read or modify sensitive data. This vulnerability is categorized as CWE\u2011352 and represents a severe flaw in state\u2011management and request validation.", "risk_and_exploitability": "The flaw scores 8.8 on CVSS, indicating high severity. While no EPSS value is published and the vulnerability is not listed in the CISA KEV catalog, the attack vector is public and does not require prior authentication. A malicious actor can craft a URL or embed a hidden form that submits to public/settings_process.php from a victim\u2019s browser or through a compromised third\u2011party site, thereby escalating privileges and extracting sensitive data. Due to the simplicity of the CSRF payload and the lack of additional access controls, the risk of exploitation remains significant."}}}}, "created": "2026-04-28T05:00:14.756265+00:00", "title": "Cross\u2011Site Request Forgery in Diskover\u2011Community Allows Privilege Escalation and Data Theft", "updated": "2026-04-28T08:45:26.953357+00:00", "vendors": ["diskoverdata", "diskoverdata$PRODUCT$diskover"]}