CVE-2026-22800

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery (CSRF) vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs a destructive action but is exposed via an HTTP GET request. Although proper authorization checks are enforced and the endpoint cannot be triggered cross-site, the use of GET allows the action to be implicitly invoked through same-site content (e.g. embedded resources rendered within the application). As a result, an authenticated administrator who views crafted content within the application may unknowingly trigger the endpoint, causing all active video conferences on the server to be terminated without explicit intent or confirmation. This vulnerability is fixed in 4.10.0.

CVSS v3 2.4 LOW

2.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/THM-Health/PILOS/commit/d9ab9bb7ac0a8581c25e24cb7db2152d40be4d1b	Patch
https://github.com/THM-Health/PILOS/security/advisories/GHSA-r24c-9p4j-rqw9	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:thm:pilos:*:*:*:*:*:*:*:*

History

21 Jan 2026, 18:42

Type	Values Removed	Values Added
References	~~() https://github.com/THM-Health/PILOS/commit/d9ab9bb7ac0a8581c25e24cb7db2152d40be4d1b -~~	() https://github.com/THM-Health/PILOS/commit/d9ab9bb7ac0a8581c25e24cb7db2152d40be4d1b - Patch
References	~~() https://github.com/THM-Health/PILOS/security/advisories/GHSA-r24c-9p4j-rqw9 -~~	() https://github.com/THM-Health/PILOS/security/advisories/GHSA-r24c-9p4j-rqw9 - Third Party Advisory
CPE		cpe:2.3:a:thm:pilos::::::::
First Time		Thm pilos Thm

12 Jan 2026, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-12 23:15

Updated : 2026-01-21 18:42

NVD link : CVE-2026-22800

Mitre link : CVE-2026-22800

CVE.ORG link : CVE-2026-22800

JSON object : View

Products Affected

thm

pilos

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2026-22800", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "published": "2026-01-12T23:15:52.747", "references": [{"url": "https://github.com/THM-Health/PILOS/commit/d9ab9bb7ac0a8581c25e24cb7db2152d40be4d1b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/THM-Health/PILOS/security/advisories/GHSA-r24c-9p4j-rqw9", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Request Forgery (CSRF) vulnerability exists in an administrative API endpoint responsible for terminating all active video conferences on a single server. The affected endpoint performs a destructive action but is exposed via an HTTP GET request. Although proper authorization checks are enforced and the endpoint cannot be triggered cross-site, the use of GET allows the action to be implicitly invoked through same-site content (e.g. embedded resources rendered within the application). As a result, an authenticated administrator who views crafted content within the application may unknowingly trigger the endpoint, causing all active video conferences on the server to be terminated without explicit intent or confirmation. This vulnerability is fixed in 4.10.0."}], "lastModified": "2026-01-21T18:42:22.607", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:thm:pilos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22DA1502-AFE6-4A80-B427-161C9B7726EB", "versionEndExcluding": "4.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}