PT-2026-2312 · Pilos+1 · Pilos+1

Samuelwei · Publicado 2026-01-12 · Atualizado 2026-01-21 · CVE-2026-22800

Positive Technologies (AI Summary)

CVSS v3.1

4.5

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PILOS versions prior to 4.10.0

Description PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. A Cross-Site Request Forgery (CSRF) issue exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint, exposed via an HTTP GET request, performs a destructive action. While authorization checks are in place, the use of a GET request allows implicit invocation through same-site content. An authenticated administrator viewing crafted content within the application may unknowingly trigger the endpoint, terminating all active video conferences without explicit intent. The vulnerable endpoint is an administrative API endpoint.

Recommendations Update to version 4.10.0 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-22800

GHSA-R24C-9P4J-RQW9

Produtos afetados

Bigbluebutton

Pilos

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22800.json · Exploit
• https://github.com/THM-Health/PILOS/security/advisories/GHSA-r24c-9p4j-rqw9 · Nota
• https://github.com/THM-Health/PILOS/commit/d9ab9bb7ac0a8581c25e24cb7db2152d40be4d1b · Correção
• https://twitter.com/CVEnew/status/2010843495229989122 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2010886201905975408 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-22800 · Aviso do Fabricante
• https://t.me/cveNotify/149428 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-22800 · Nota de Segurança