Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2026-27632

2.6 · LOW

Talishar is a fan-made Flesh and Blood project.

Published Feb 25, 2026CWE-352EPSS 0.12%

Overview

CVE-2026-27632 is a low-severity vulnerability. It was published on February 25, 2026 and has a CVSS 3.1 base score of 2.6 (LOW).

This vulnerability has a CVSS 3.1 base score of 2.6, rated LOW. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

Technical description

Talishar is a fan-made Flesh and Blood project. Prior to commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48, the Talishar application lacks Cross-Site Request Forgery (CSRF) protections on critical state-changing endpoints, specifically within `SubmitChat.php` and other game interaction handlers. By failing to require unique, unpredictable session tokens, the application allows third-party malicious websites to forge requests on behalf of authenticated users, leading to unauthorized actions within active game sessions. The attacker would need to know both the proper gameName and playerID for the player. The player would also need to be browsing and interact with the infected website while playing a game. The vulnerability is fixed in commit 6be3871a14c192d1fb8146cdbc76f29f27c1cf48.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

GitHubgithub.com/Talishar/Talishar/security/advisories/GHSA-73mm-323r-cm3g

How CyberStrike helps

Frequently asked questions

What is CVE-2026-27632?

CVE-2026-27632 is a low-severity vulnerability. It was published on February 25, 2026 and has a CVSS 3.1 base score of 2.6 (LOW).

How severe is CVE-2026-27632?

This vulnerability has a CVSS 3.1 base score of 2.6, rated LOW. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2026-27632?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-27632?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2026-27632 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related LOW CVEs from 2026

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999