CVE-2026-22800: fallo de gravedad baja en THM-Health PILOS
PILOS affected by a CSRF via GET request allows unintentional termination of all active video conferences
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 2.4epss 0.2%
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery (CSRF) vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs a destructive action but is exposed via an HTTP GET request. Although proper authorization checks are enforced and the endpoint cannot be triggered cross-site, the use of GET allows the action to be implicitly invoked through same-site content (e.g. embedded resources rendered within the application). As a result, an authenticated administrator who views crafted content within the application may unknowingly trigger the endpoint, causing all active video conferences on the server to be terminated without explicit intent or confirmation. This vulnerability is fixed in 4.10.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L
Productos afectados
THM-Health · PILOSCVEs relacionadas — THM-Health PILOS
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-47107HIGHPILOS account takeover through password reset poisoningEPSS 0.6%CVE-2026-71555MEDIUMPILOS: Reverse tabnabbing in room descriptionEPSS 0.3%CVE-2025-62524MEDIUMPILOS Exposes PHP versionEPSS 0.3%CVE-2025-62523MEDIUMPILOS Misconfigured the Access-Control-Allow-Origin HeaderEPSS 0.2%CVE-2025-62781MEDIUMPILOS is missing session regeneration after password changeEPSS 0.2%