The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to trigger email‑change and password‑change actions on behalf of an authenticated user by sending a forged POST request from a malicious site. The consequence is that the victim’s account credentials can be altered without their knowledge, potentially leading to account takeover and unauthorized access to sensitive data. This weakness is classified as CWE‑352.

The affected system is KTM System e‑BOK. No version information is supplied, so any installation of this product that has not applied the June 2026 patch is potentially vulnerable.

The CVSS score of 5.1 indicates a medium severity vulnerability. The EPSS score is not available, and the issue is not listed in CISA KEV, suggesting no known exploitation campaigns at this time. The attack requires that the victim be logged into the application and visit a malicious webpage, so the exploit is mitigated by CSRF protections. However, if those controls are absent, the risk is higher.