CVE-2021-47754 Arunna 1.0.0 - 'Multiple' Cross-Site Request Forgery (CSRF)
Attackers can trick authenticated users into submitting malicious forms to change profile details, including passwords and administrative privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-47754?
CVE-2021-47754 is a medium-severity vulnerability in Arunna, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Arunna 1.0.0 contains a cross-site request forgery vulnerability that allows attackers to manipulate user profile settings without authentication. Attackers can craft a malicious form to change user details, including passwords, email, and administrative privileges by tricking authenticated users into submitting the form.
Weakness: CWE-352
Which versions are affected by CVE-2021-47754?
It affects 1 product.
Products include Arunna Arunna.
How do I fix CVE-2021-47754?
No fix has been published for CVE-2021-47754 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-47754 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47754 exists.
Sources
Also known as GHSA-2xfw-9v88-vhpx.