FKIE_CVE-2026-43985

Vulnerability from fkie_nvd - Published: 2026-06-04 16:16 - Updated: 2026-07-22 20:10
Severity
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `configUpdate` as a state-changing administrator endpoint, but the route does not enforce `POST` and does not use any anti-CSRF token. In the default form and JWT-based authentication mode, the administrator session cookie is issued with `SameSite=Lax`, which still permits top-level cross-site navigation requests. An attacker can exploit this by luring a logged-in administrator to a malicious page that submits a cross-site request to `/configUpdate` and overwrites the local administrator username and password. The attacker can then sign in directly with the chosen credentials and take over the Tautulli administrative interface. Version 2.17.1 patches the issue.
References
security-advisories@github.comhttps://github.com/Tautulli/Tautulli/releases/tag/v2.17.1
security-advisories@github.comhttps://github.com/Tautulli/Tautulli/security/advisories/GHSA-v622-pmjj-gpx3
134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/Tautulli/Tautulli/security/advisories/GHSA-v622-pmjj-gpx3
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Tautulli",
          "vendor": "Tautulli",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.17.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `configUpdate` as a state-changing administrator endpoint, but the route does not enforce `POST` and does not use any anti-CSRF token. In the default form and JWT-based authentication mode, the administrator session cookie is issued with `SameSite=Lax`, which still permits top-level cross-site navigation requests. An attacker can exploit this by luring a logged-in administrator to a malicious page that submits a cross-site request to `/configUpdate` and overwrites the local administrator username and password. The attacker can then sign in directly with the chosen credentials and take over the Tautulli administrative interface. Version 2.17.1 patches the issue."
    },
    {
      "lang": "es",
      "value": "Tautulli es una herramienta de monitoreo y seguimiento basada en Python para Plex Media Server. Las versiones anteriores a la 2.17.1 exponen \u0027configUpdate\u0027 como un endpoint de administrador que cambia el estado, pero la ruta no fuerza \u0027POST\u0027 y no utiliza ning\u00fan token anti-CSRF. En el modo de autenticaci\u00f3n predeterminado basado en formulario y JWT, la cookie de sesi\u00f3n del administrador se emite con \u0027SameSite=Lax\u0027, lo que a\u00fan permite solicitudes de navegaci\u00f3n entre sitios de nivel superior. Un atacante puede explotar esto atrayendo a un administrador que ha iniciado sesi\u00f3n a una p\u00e1gina maliciosa que env\u00eda una solicitud entre sitios a /configUpdate y sobrescribe el nombre de usuario y la contrase\u00f1a del administrador local. El atacante puede entonces iniciar sesi\u00f3n directamente con las credenciales elegidas y tomar el control de la interfaz administrativa de Tautulli. La versi\u00f3n 2.17.1 corrige el problema."
    }
  ],
  "id": "CVE-2026-43985",
  "lastModified": "2026-07-22T20:10:00.127",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-43985",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-04T17:51:21.123267Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-04T16:16:38.083",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Tautulli/Tautulli/security/advisories/GHSA-v622-pmjj-gpx3"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/Tautulli/Tautulli/security/advisories/GHSA-v622-pmjj-gpx3"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.