Diskover‑Community versions 2.3.5 and earlier contain a Cross‑Site Request Forgery flaw in public/settings_process.php that allows a remote attacker to send forged requests which the application accepts as legitimate. The attacker can thus raise privileges within the application and read or modify sensitive data. This vulnerability is categorized as CWE‑352 and represents a severe flaw in state‑management and request validation.

All installations of the Diskover‑Data community edition are affected. Any instance running version 2.3.5 or earlier is vulnerable; no later release is known to be vulnerable.

The flaw scores 8.8 on CVSS, indicating high severity. While no EPSS value is published and the vulnerability is not listed in the CISA KEV catalog, the attack vector is public and does not require prior authentication. A malicious actor can craft a URL or embed a hidden form that submits to public/settings_process.php from a victim’s browser or through a compromised third‑party site, thereby escalating privileges and extracting sensitive data. Due to the simplicity of the CSRF payload and the lack of additional access controls, the risk of exploitation remains significant.