Executive brief
Diskover Community, a data management and file indexing platform, contains a security flaw that allows an attacker to trick an administrator into unknowingly changing system settings. By directing a logged-in administrator to a malicious website, an attacker can remotely disable the requirement for a password to access the system. This results in a complete bypass of security controls, allowing unauthorized individuals to view sensitive file metadata, exfiltrate data, or delete indexed information.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'public/settings_process.php' component of diskover-community versions 2.3.5 and prior. The application fails to implement or validate CSRF tokens for sensitive POST requests, specifically within the 'webotherform' form handler. An attacker can exploit this by inducing an authenticated administrator to visit a malicious webpage that submits a hidden form to the vulnerable endpoint. By setting the 'LOGIN_REQUIRED' parameter to 'false', the attacker can disable authentication for the entire application, leading to unauthorized access to the dashboard and underlying Elasticsearch data. Mitigation requires implementing per-session CSRF tokens and validating them on all state-changing requests.
Affected products
- diskoverdata diskover-community <= 2.3.5
Timeline
- 2026-04-27: disclosed: Initial NVD publication and researcher write-up released.