A vulnerability was discovered in the Multiple Endpoints component of Newbee‑ltd Newbee‑mall that allows an attacker to perform Cross‑Site Request Forgery (CSRF) by manipulating an unknown function. The flaw permits remote exploitation, enabling a malicious website or script to trigger state‑changing actions on the target application without the victim’s knowledge. The reported CVE lists a CVSS score of 5.3, indicating a moderate impact if the victim is logged in or holds privileged permissions. The weakness is classified as CWE‑352 (CSRF) and CWE‑862 (Missing Authorization).

The vendor affected is Newbee‑ltd, with the product Newbee‑mall. Versions up to the commit a069069b07027613bf0e7f571736be86f431faee are known to contain the vulnerable component. Because the project uses a rolling‑release model, no explicit release numbers are available, and the vendor has not yet announced a fix. Users must therefore inspect their current commit or release hash to determine whether they are running a vulnerable instance.

The CVSS Base score of 5.3 reflects a moderate exploitability, while the EPSS score of less than 1 % shows that, in the present data, exploitation likelihood is low. The vulnerability is not listed in the CISA KEV catalog, suggesting no active, widespread attacks are documented. Attackers can trigger the flaw remotely by issuing a crafted HTTP request to the affected endpoint, leveraging the absence of proper CSRF validation. If the user is an authenticated session, the attacker could perform actions such as changing user data, ordering items, or modifying application state.