CVE-2026-39718

{
  "etk_id": "ETK-2026-371",
  "cve_id": "CVE-2026-39718",
  "display_id": "CVE-2026-39718",
  "ghsa_id": "GHSA-p2px-q24r-qwp5",
  "euvd_id": "EUVD-2026-91774",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-site request forgery in Webriti Wallstreet",
  "summary": "Webriti Wallstreet through version 2.8.6 is affected by a cross-site request forgery flaw. An attacker may trigger unintended actions through a victim's authenticated browser if they can persuade a logged-in user to visit attacker-controlled content.",
  "mitigation": "Limit access to Wallstreet administrative functions and instruct privileged users not to follow untrusted links while using authenticated sessions. Monitor for an updated release and apply it promptly when available.",
  "vendor": "Webriti",
  "product": "Wallstreet",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2.8.6"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "wallstreet",
      "purl": null
    }
  ],
  "cwes": [
    352
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss_score": 0.0014,
  "epss_percentile": 0.0325,
  "epss_asof": "2026-10-21",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 33.118227133333335,
  "t0_at": "2026-10-02T19:16:31.625000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-02T20:33:50.099151+00:00",
      "days": 0.053686043414351854,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T19:16:31.625000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-02T19:16:31.625000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T19:16:31.625000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39718"
    }
  }
}