CVE-2026-39633

CVE-2026-39633 is a Cross-Site Request Forgery (CSRF) vulnerability affecting ThemeGoods Grand Car Rental versions 3.6.9 and earlier. This flaw allows attackers to perform unauthorized actions on behalf of authenticated users by leveraging the application's insufficient CSRF protections. The vulnerability is classified as medium severity with a CVSS score of 6.5, reflecting moderate but meaningful risk to affected deployments. The attack requires network access with low complexity and can be executed remotely without special privileges, though it does require user interaction and an authenticated session. The vulnerability impacts confidentiality, integrity, and availability to a limited degree, with exploitation resulting in potential unauthorized transactions or data manipulation within the car rental platform. There is no evidence of active exploitation in the wild, as indicated by the absence of CISA KEV listing and inactive status on vulnerability tracking lists. The EPSS score of 0.00014 suggests minimal real-world exploitation probability, and community attention remains limited. Organizations running Grand Car Rental should implement CSRF tokens and security headers while monitoring for patch availability from ThemeGoods.