CVE-2026-35096
Last modified
CVE-2026-35096 is a medium-severity vulnerability rated 5.1/10 on the CVSS scale. KTM System e-BOK is vulnerable to Cross‑Site Request Forgery (CSRF) in both the email-change and password-change functionalities. An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged POST request to the application.
Description
KTM System e-BOK is vulnerable to Cross‑Site Request Forgery (CSRF) in both the email-change and password-change functionalities. An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged POST request to the application. This allows the attacker to trigger an unauthorized email or password change on behalf of the victim without their knowledge or interaction. This issue was fixed in the patch published in June 2026.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-35096?
How severe is CVE-2026-35096?
How do I fix CVE-2026-35096?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-35090In Slican telephone exchanges it is possible to manage the c…9.3
- CVE-2026-35091A flaw was found in Corosync. A remote unauthenticated attac…8.2
- CVE-2026-35092A flaw was found in Corosync. An integer overflow vulnerabil…7.5
- CVE-2026-35093A flaw was found in libinput. A local attacker who can place…8.8
- CVE-2026-35094A flaw was found in libinput. An attacker capable of deployi…5.5
- CVE-2026-35095KTM System e-BOK allows the session identifier to be set by …4.8
- CVE-2026-35097KTM System e-BOK enforces a maximum password length of six n…6.9
- CVE-2026-35098KTM System e-BOK does not implement any limit or timeout on …6.9
- CVE-2026-35099Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condi…7.4
- CVE-2026-3511Improper Restriction of XML External Entity Reference vulner…8.6
- CVE-2026-3512The Writeprint Stylometry plugin for WordPress is vulnerable…6.1
- CVE-2026-3513The TableOn – WordPress Posts Table Filterable plugin for Wo…6.4
Are you affected by CVE-2026-35096?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST