A CSRF vulnerability in the administrative API of the PILOS platform allows the deletion of all active video conferences when the endpoint is invoked via an HTTP GET request. Because the performed action is destructive, any accidental or malicious trigger can suspend all ongoing meetings, leading to a significant disruption of service availability. The weakness is identified as a request forgery flaw (CWE-352).

The flaw exists in THM‑Health PILOS versions earlier than 4.10.0, which are used as frontends for BigBlueButton. Administrators with authenticated access to the application can potentially trigger the endpoint by viewing crafted content that invokes the GET URL within the application context.

The CVSS score is 2.4, indicating a low severity. The EPSS score is below 1 %, suggesting a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need an authenticated administrator to view crafted content within the same site, which would trigger the same‑site GET request to the termination endpoint. The endpoint is protected against cross‑site requests and requires administrative access, so the attack relies on a single administrator session. The impact is limited to the server’s active conferences; however, terminating all meetings simultaneously can disrupt service.