CVE-2026-43985

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `configUpdate` as a state-changing administrator endpoint, but the route does not enforce `POST` and does not use any anti-CSRF token. In the default form and JWT-based authentication mode, the administrator session cookie is issued with `SameSite=Lax`, which still permits top-level cross-site navigation requests. An attacker can exploit this by luring a logged-in administrator to a malicious page that submits a cross-site request to `/configUpdate` and overwrites the local administrator username and password. The attacker can then sign in directly with the chosen credentials and take over the Tautulli administrative interface. Version 2.17.1 patches the issue.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1
https://github.com/Tautulli/Tautulli/security/advisories/GHSA-v622-pmjj-gpx3
https://github.com/Tautulli/Tautulli/security/advisories/GHSA-v622-pmjj-gpx3

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-04 16:16

Updated : 2026-07-22 20:10

NVD link : CVE-2026-43985

Mitre link : CVE-2026-43985

CVE.ORG link : CVE-2026-43985

JSON object : View

Products Affected

No product.

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2026-43985", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43985", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-04T17:51:21.123267Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Tautulli", "product": "Tautulli", "versions": [{"status": "affected", "version": "< 2.17.1"}]}]}], "published": "2026-06-04T16:16:38.083", "references": [{"url": "https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/Tautulli/Tautulli/security/advisories/GHSA-v622-pmjj-gpx3", "source": "security-advisories@github.com"}, {"url": "https://github.com/Tautulli/Tautulli/security/advisories/GHSA-v622-pmjj-gpx3", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `configUpdate` as a state-changing administrator endpoint, but the route does not enforce `POST` and does not use any anti-CSRF token. In the default form and JWT-based authentication mode, the administrator session cookie is issued with `SameSite=Lax`, which still permits top-level cross-site navigation requests. An attacker can exploit this by luring a logged-in administrator to a malicious page that submits a cross-site request to `/configUpdate` and overwrites the local administrator username and password. The attacker can then sign in directly with the chosen credentials and take over the Tautulli administrative interface. Version 2.17.1 patches the issue."}, {"lang": "es", "value": "Tautulli es una herramienta de monitoreo y seguimiento basada en Python para Plex Media Server. Las versiones anteriores a la 2.17.1 exponen 'configUpdate' como un endpoint de administrador que cambia el estado, pero la ruta no fuerza 'POST' y no utiliza ning\u00fan token anti-CSRF. En el modo de autenticaci\u00f3n predeterminado basado en formulario y JWT, la cookie de sesi\u00f3n del administrador se emite con 'SameSite=Lax', lo que a\u00fan permite solicitudes de navegaci\u00f3n entre sitios de nivel superior. Un atacante puede explotar esto atrayendo a un administrador que ha iniciado sesi\u00f3n a una p\u00e1gina maliciosa que env\u00eda una solicitud entre sitios a /configUpdate y sobrescribe el nombre de usuario y la contrase\u00f1a del administrador local. El atacante puede entonces iniciar sesi\u00f3n directamente con las credenciales elegidas y tomar el control de la interfaz administrativa de Tautulli. La versi\u00f3n 2.17.1 corrige el problema."}], "lastModified": "2026-07-22T20:10:00.127", "sourceIdentifier": "security-advisories@github.com"}