PT-2026-2312 · Pilos+1 · Pilos+1

Samuelwei · Published 2026-01-12 · Updated 2026-01-21 · CVE-2026-22800

Positive Technologies (AI Summary)

CVSS v3.1

4.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PILOS versions prior to 4.10.0

Description PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. A Cross-Site Request Forgery (CSRF) issue exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint, exposed via an HTTP GET request, performs a destructive action. While authorization checks are in place, the use of a GET request allows implicit invocation through same-site content. An authenticated administrator viewing crafted content within the application may unknowingly trigger the endpoint, terminating all active video conferences without explicit intent. The vulnerable endpoint is an administrative API endpoint.

Recommendations Update to version 4.10.0 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-22800

GHSA-R24C-9P4J-RQW9

Affected Products

Bigbluebutton

Pilos

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22800.json · Exploit
• https://github.com/THM-Health/PILOS/commit/d9ab9bb7ac0a8581c25e24cb7db2152d40be4d1b · Patch
• https://osv.dev/vulnerability/CVE-2026-22800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22800 · Security Note
• https://github.com/THM-Health/PILOS/security/advisories/GHSA-r24c-9p4j-rqw9 · Note
• https://twitter.com/CVEnew/status/2010843495229989122 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2010886201905975408 · Twitter Post
• https://t.me/cveNotify/149428 · Telegram Post