{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:thm:pilos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "22DA1502-AFE6-4A80-B427-161C9B7726EB",
              "versionEndExcluding": "4.10.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery (CSRF) vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs a destructive action but is exposed via an HTTP GET request. Although proper authorization checks are enforced and the endpoint cannot be triggered cross-site, the use of GET allows the action to be implicitly invoked through same-site content (e.g. embedded resources rendered within the application). As a result, an authenticated administrator who views crafted content within the application may unknowingly trigger the endpoint, causing all active video conferences on the server to be terminated without explicit intent or confirmation. This vulnerability is fixed in 4.10.0."
    },
    {
      "lang": "es",
      "value": "PILOS (Plataforma para Seminarios Interactivos en Vivo en L\u00ednea) es un frontend para BigBlueButton. Antes de la versi\u00f3n 4.10.0, existe una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en un endpoint de API administrativo responsable de terminar todas las videoconferencias activas en un \u00fanico servidor. El endpoint afectado realiza una acci\u00f3n destructiva pero est\u00e1 expuesto a trav\u00e9s de una petici\u00f3n HTTP GET. Aunque se aplican comprobaciones de autorizaci\u00f3n adecuadas y el endpoint no puede ser activado de forma cruzada, el uso de GET permite que la acci\u00f3n sea invocada impl\u00edcitamente a trav\u00e9s de contenido del mismo sitio (por ejemplo, recursos incrustados renderizados dentro de la aplicaci\u00f3n). Como resultado, un administrador autenticado que visualice contenido malicioso dentro de la aplicaci\u00f3n podr\u00eda activar el endpoint sin saberlo, provocando que todas las videoconferencias activas en el servidor sean terminadas sin intenci\u00f3n expl\u00edcita o confirmaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 4.10.0."
    }
  ],
  "id": "CVE-2026-22800",
  "lastModified": "2026-01-21T18:42:22.607",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 2.4,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 4.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-01-12T23:15:52.747",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/THM-Health/PILOS/commit/d9ab9bb7ac0a8581c25e24cb7db2152d40be4d1b"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/THM-Health/PILOS/security/advisories/GHSA-r24c-9p4j-rqw9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}