DivvyDrive Information Technologies Inc. disclosed a Cross‑Site Request Forgery (CSRF) vulnerability that allows malicious actors to convince authenticated users to submit unintended requests, potentially altering data or initiating actions without the user’s consent. This flaw corresponds to CWE‑352 and can lead to accidental or malicious changes in system state, compromising data integrity and trust.

The vulnerability affects DivvyDrive versions starting at 4.8.2.9 up to, but not including, 4.8.3.2. Systems running any 4.8.2.x or earlier 4.8.3.x build are exposed.

The CVSS score of 9.6 reflects a high‐level risk. Although EPSS data is not available, the absence of a KEV listing does not diminish the immediate need for remediation. Attackers can exploit the flaw by embedding crafted requests in emails, external sites, or social media posts; the victim must be authenticated in the target system. Successful exploitation results in the attacker performing privileged actions on behalf of the user without further interaction.