CVE-2026-54220

Cross-Site Request Forgery in UBB.threads

Published Jun 18, 2026 CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Description

uBB.threads is vulnerable to a Cross-Site Request Forgery (CSRF) due to a lack of protective mechanisms. This allows an attacker to trick an authenticated user into executing unintended actions.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.

Analysis

Technical impact

The vulnerability in UBB.threads is a classic Cross‑Site Request Forgery (CSRF) flaw (CWE-352) arising from the absence of protective mechanisms. An attacker can lure a logged‑in user into executing an action without the user’s intent, leading to unauthorized changes or actions executed with the victim’s privileges.

Affected Systems

The flaw has been confirmed in UBB Systems’ UBB.threads version 7.7.5, and it may also be present in other, earlier or later releases.

Risk and Exploitability

The CVSS score of 8.6 classifies this as high severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack path requires an attacker to persuade a legitimate user to access a crafted link or submit a malicious request, which then triggers an action on the target system under the user’s authenticated session. Without remedial code, affected deployments are vulnerable to potentially arbitrary operations performed in the users’ names.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

UBB Systems

UBB.threads

unknown

Version	Status	Constraints
`0`	affected	≤ 7.7.5

No data.

Vendor Product Versions

Ubb Systems

Ubb.threads

Version	Status	Scheme	Platform
`[0,7.7.5]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply any vendor‑released patch or upgrade to a version that includes a CSRF mitigation when it becomes available
Deploy a web application firewall or proxy that detects and blocks forged cross‑site requests to protect against illicit actions
Restrict the scope of authenticated user permissions and enforce principle of least privilege to minimize potential damage if CSRF succeeds

Generated by OpenCVE AI on June 18, 2026 at 20:25 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.187% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://cert.pl/en/posts/2026/06/CVE-2026-54219
https://www.ubbcentral.com/

History

Jun 21, 2026 9:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Ubb Systems Ubb Systems ubb.threads
Vendors & Products		Ubb Systems Ubb Systems ubb.threads

Jun 18, 2026 4:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		uBB.threads is vulnerable to a Cross-Site Request Forgery (CSRF) due to a lack of protective mechanisms. This allows an attacker to trick an authenticated user into executing unintended actions. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.
Title		Cross-Site Request Forgery in UBB.threads
Weaknesses		CWE-352
References		https://cert.pl/en/posts/2026/06/CVE-2026-54219 https://www.ubbcentral.com/
Metrics		cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`