CVE-2026-27632
Last modified
CVE-2026-27632 is a low-severity vulnerability rated 3.1/10 on the CVSS scale. Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48, the Talishar application lacks Cross-Site Request Forgery (CSRF) protections on critical state-changing endpoints, specifically within `SubmitChat.php` and other game interaction handlers. EPSS estimates a 0.09% chance of exploitation in the next 30 days.
Description
Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48, the Talishar application lacks Cross-Site Request Forgery (CSRF) protections on critical state-changing endpoints, specifically within `SubmitChat.php` and other game interaction handlers. By failing to require unique, unpredictable session tokens, the application allows third-party malicious websites to forge requests on behalf of authenticated users, leading to unauthorized actions within active game sessions. The attacker would need to know both the proper gameName and playerID for the player. The player would also need to be browsing and interact with the infected website while playing a game. The vulnerability is fixed in commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Talishar | Talishar | < 2026-02-22 |
References
- https://github.com/Talishar/Talishar/security/advisories/GHSA-73mm-323r-cm3gExploit, Mitigation, Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-27632?
How severe is CVE-2026-27632?
How do I fix CVE-2026-27632?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-27627Karakeep is a elf-hostable bookmark-everything app. In versi…6.1
- CVE-2026-27628pypdf is a free and open-source pure-python PDF library. Pri…7.5
- CVE-2026-27629InvenTree is an Open Source Inventory Management System. Pri…8.8
- CVE-2026-2763Use-after-free in the JavaScript Engine component. This vuln…9.8
- CVE-2026-27630TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …7.5
- CVE-2026-27631Exiv2 is a C++ library and a command-line utility to read, w…5.3
- CVE-2026-27633TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …7.5
- CVE-2026-27634Piwigo is an open source photo gallery application for the w…9.8
- CVE-2026-27635Manyfold is an open source, self-hosted web application for …8.8
- CVE-2026-27636FreeScout is a free help desk and shared inbox built with PH…8.8
- CVE-2026-27637FreeScout is a free help desk and shared inbox built with PH…9.8
- CVE-2026-27638Actual is a local-first personal finance tool. Prior to vers…7.1
Are you affected by CVE-2026-27632?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST