CVE-2026-31014

Dovestones Software's AD Self Update versions prior to 4.0.0.5 contain a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to modify user account information without authentication. The affected endpoint fails to implement CSRF token validation and accepts both POST and GET requests for state-changing operations, creating a direct pathway for unauthorized account modifications. The vulnerability carries a CVSS score of 6.3 (Medium severity) with a network-based attack vector requiring minimal complexity and user interaction. An authenticated user's visit to a malicious webpage crafted by an attacker can result in unauthorized changes to user account details, representing a moderate confidentiality, integrity, and availability impact. The EPSS score of 0.00014 indicates this threat is currently uncommon among disclosed vulnerabilities. The vulnerability is not currently listed in the Known Exploited Vulnerabilities catalog and shows no signs of active exploitation. No public exploit code is known to be available, and community attention remains minimal. However, organizations running AD Self Update versions below 4.0.0.5 should prioritize upgrading to mitigate the risk of opportunistic exploitation, particularly in environments where users may visit untrusted websites while authenticated to administrative systems.