Diskover‑Community versions 2.3.5 and earlier contain a Cross‑Site Request Forgery flaw in the file public/settings_process.php. A remote attacker can send forged HTTP requests that the application accepts as legitimate, allowing the attacker to elevate privileges within the application and read or modify sensitive data. This vulnerability is classified as CWE‑352 and represents a severe flaw in state‑management and request validation.

All installations of the Diskover‑Data community edition are affected. Any instance running version 2.3.5 or earlier is vulnerable; newer releases are not known to be affected.

The flaw scores 8.8 on CVSS, indicating high severity. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is public and does not require prior authentication; a malicious actor can craft a forged request via a victim’s browser or a hidden form submitted to public/settings_process.php from a compromised third‑party site. Due to the simplicity of the CSRF payload and the lack of additional access controls, the risk of exploitation remains significant.