Pandora FMS versions 777 through 800 contain a Cross‑Site Request Forgery flaw that allows an attacker to follow a crafted web page and cause the victim’s browser to perform privileged actions without the victim’s consent. The vulnerability permits unauthorized integrity‑violating operations, such as modifying configuration, creating users, or accessing sensitive data, and is categorized as CWE‑352.

All deployments of Pandora FMS from version 777 up to and including 800 are affected. The vendor lists the vulnerable product as Pandora FMS.

The CVSS score is 7.1, indicating high severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified precisely; the vulnerability is not listed in the CISA KEV catalog. Because CSRF exploits generally require the victim to be authenticated and to be visiting a malicious link, the attack vector is inferred to be web‑based and likely relies on a logged‑in user’s session. The vulnerability does not require network‑level access and can be triggered remotely by an attacker who lures the victim to a malicious URL.