CVE-2026-39617
A critical CSRF vulnerability exists in the Bluestreet application (versions up to 1.7.3). An attacker can trick a logged‑in user into performing unintended actions, such as modifying or deleting data. The flaw is caused by missing CSRF protection in the application.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Bluestreet web application, versions 1.7.3 and earlier, typically used by web developers and site administrators.
Real-world impact
An attacker could cause a victim to unknowingly submit requests that alter or delete data, potentially leading to data loss, unauthorized changes, or other disruptive effects.
Why this severity
The CVSS score of 9.6 reflects the high impact on confidentiality, integrity, and availability, the fact that the vulnerability can be exploited over the network with no authentication, and that it only requires a user interaction such as clicking a link.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Apr 8, 2026 · Apr 8, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.