The vulnerability is a Cross‑Site Request Forgery flaw in Dovestones Softwares AD Self Update, versioned below 4.0.0.5. The endpoint processes state‑changing requests without requiring a CSRF token, allowing an attacker to send modifications to user account data without the user’s consent. The endpoint accepts application/x-www-form-urlencoded requests, and an originally POST‑based request can be converted to a GET request while still succeeding in updating user details. This creates a path for an attacker to craft a malicious request that will be executed automatically when an authenticated user visits a link or submits a form. The result is that user account information can be altered without authorization, compromising privacy and potentially degrading system integrity. If the system also permits further actions after the update, broader consequences are possible. The CVSS score of 6.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no publicly known exploitation to date. The likely attack vector is inferred to be a malicious link or form presented to an authenticated user, triggering the unauthorized request internally. The risk depends on how often users authenticate and the exposure of the affected endpoint.

Dovestones Softwares AD Self Update (version < 4.0.0.5) is the only affected product.

The vulnerability is a CSRF flaw that permits state‑changing requests without a CSRF token or equivalent protection. Because the endpoint accepts application/x-www-form-urlencoded requests and allows an originally POST‑based request to be converted to GET while still succeeding, an attacker can craft a malicious request that an authenticated user will automatically trigger by visiting a link or submitting a form. This yields unauthorized updates to user account details. The CVSS score of 6.3 indicates moderate severity, and with the EPSS value not available, the exact exploitation likelihood remains uncertain, but the absence from the CISA KEV catalog suggests limited public exploitation as of now.