CVE-2026-73847

Name of the Vulnerable Software and Affected Versions Emlog versions prior to 2.6.27

Description Missing Cross-Site Request Forgery (CSRF) protection—a flaw where a web application fails to verify that a request was intentionally sent by the user—on the AI Assistant execute tool action in the 'admin/ai.php' endpoint allows a remote unauthenticated attacker to submit forged requests to a recently logged-in administrator. This is facilitated by the authentication cookie in include/lib/loginauth.php lacking a SameSite attribute. The query database case passes attacker-controlled sql and confirm code variables to the Ai::queryDatabase() function in include/service/ai.php. While the blog table is write-protected, read queries require no confirmation, and write queries accept a public confirmation string. Additionally, aliasing password as pwd hash bypasses output redaction, potentially allowing an attacker to read all database tables and modify any table except the blog, which can lead to full administrator account takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.