CVE-2026-39617 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Bluestreet version 1.7.3 and earlier, developed by priyanshumittal. This vulnerability allows unauthenticated attackers to perform unauthorized actions on behalf of legitimate users through malicious web requests. The vulnerability carries a critical CVSS score of 9.6, with a network-based attack vector requiring minimal complexity and only user interaction to exploit. The attack has widespread impact potential, enabling attackers to compromise confidentiality, integrity, and availability across connected systems and potentially affecting multiple users or domains. Exploitation status indicates this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the wild. The extremely low EPSS score of 0.000190 and inactive hot list status suggest minimal community attention and exploitation activity at this time, though the critical severity warrants immediate patching for all affected Bluestreet installations.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Priyanshumittal | Bluestreet | >= 0, <= 1.7.3CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.8 Bluesky, 0.5 Mastodon, and 1.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.