The vulnerability is a CSRF flaw that allows an attacker to change the administrator username and password on a Tautulli instance. By luring a logged‑in administrator to a malicious page, an attacker can submit a cross‑site request to the \/configUpdate endpoint, which does not enforce POST or an anti‑CSRF token. The session cookie is sent with SameSite=Lax, so the request is accepted. The attacker then can authenticate with the new credentials and take full control of the Tautulli administrative interface. The weakness is a classic CSRF issue (CWE-352) and leads to direct privilege escalation without requiring code execution on the server.

The flaw exists in Tautulli versions before 2.17.1. The affected product is the Tautulli monitoring and tracking tool for Plex Media Server. Any installation that uses a default configuration and has administrator access is vulnerable, unless the underlying version is upgraded to 2.17.1 or newer.

The CVSS score of 8.8 indicates a high severity flaw. The EPSS score is not available, so the exact exploitation probability is unknown, but the lack of anti‑CSRF and method restriction makes the attack trivial for any user who can persuade an administrator to visit a malicious site. The vulnerability is not listed in the CISA KEV catalog, yet its impact is significant because it compromises the sole administrative account. If a user is unaware of the update, re‑authentication can be performed with the user‑controlled credentials immediately after the attack.