CVE-2026-116863

{
  "etk_id": "ETK-2026-2796",
  "cve_id": "CVE-2026-116863",
  "display_id": "CVE-2026-116863",
  "ghsa_id": "GHSA-r394-jh8x-rp4v",
  "euvd_id": "EUVD-2026-111144",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-site request forgery in Tribulant Newsletters",
  "summary": "Tribulant Software Newsletters versions through 4.18.2 are affected by a cross-site request forgery flaw. An attacker may be able to cause actions in the application when they can persuade a user with an active session to visit attacker-controlled content.",
  "mitigation": "Update Newsletters to a vendor release later than 4.18.2 after confirming that it addresses this issue. Until an update is available, disable the component where feasible and restrict access to the affected site's administrative interface.",
  "vendor": "Tribulant Software",
  "product": "Newsletters",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 4.18.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "newsletters-lite",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.01290505,
  "t0_at": "2026-10-27T15:56:41.312000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-27T21:21:03.401151+00:00",
      "days": 0.22525566146990741,
      "is_lower_bound": false,
      "measured_at": "2026-10-27T15:56:41.312000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-27T15:56:41.312000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-27T15:56:41.312000+00:00",
      "url": "https://github.com/advisories/GHSA-r394-jh8x-rp4v"
    }
  }
}