The flaw is present in the Jivejdon forum software through version 5.0 and lets a remote attacker initiate state‑changing actions without the attacker’s own authentication by exploiting GET endpoints that lack CSRF protection. An attacker can craft URLs that cause an authenticated user to delete all private messages, delete subscriptions, or rename threads. Because these actions occur without the user’s knowledge, the attacker can silently erase user data and disrupt forum organization, directly compromising data integrity and availability for affected accounts.

All deployments of Banq Jivejdon up to and including revision 5.0 that expose the GET routes /account/protected/delAll, /account/protected/sub/delSub, and /message/updateAction are vulnerable. Administrators of older Jivejdon installations should treat the software as compromised until a version that mitigates CSRF on these paths is deployed.

The CVSS base score of 5.3 shows medium severity, and while an EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploitation yet. Exploitation requires the attacker to lure an authenticated user to click a crafted link, but once the link is visited the privileged action is performed immediately. Consequently, the risk to user data is real and the likelihood of exploitation is moderate in environments where users may be targeted by phishing attempts.