PT-2026-46258 · Tautulli · Tautulli
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Tautulli versions prior to 2.17.1
Description
Tautulli exposes the
/configUpdate administrator endpoint for state-changing operations without enforcing the POST method or utilizing anti-CSRF (Cross-Site Request Forgery) tokens. In default form and JWT-based authentication modes, the administrator session cookie uses SameSite=Lax, which allows top-level cross-site navigation requests. An attacker can lure an authenticated administrator to a malicious page that sends a cross-site request to the /configUpdate endpoint to overwrite the local administrator username and password, leading to a full takeover of the administrative interface.Recommendations
Update to version 2.17.1.
Exploit
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tautulli