PT-2026-21847 · Talishar · Talishar

Qu0Kk4 · Publicado 2026-02-25 · Atualizado 2026-02-25 · CVE-2026-27632

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Talishar versions prior to commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48

Description The Talishar application does not have Cross-Site Request Forgery (CSRF) protections on critical endpoints that change application state. Specifically, the SubmitChat.php file and other game interaction handlers are affected. This allows malicious websites to forge requests on behalf of authenticated users, potentially leading to unauthorized actions within active game sessions. An attacker would need to know the gameName and playerID of the player, and the player would need to be browsing the malicious website while playing a game.

Recommendations Update to commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-27632

GHSA-73MM-323R-CM3G

Produtos afetados

Talishar

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27632.json · Exploit
• https://github.com/Talishar/Talishar/security/advisories/GHSA-73mm-323r-cm3g · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-27632 · Nota de Segurança
• https://twitter.com/CVEnew/status/2026641363521995096 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-27632 · Aviso do Fabricante