CVE-2026-112836

Summary

Cross-Site Request Forgery (CSRF) in VikRentCar v1.4.8 and earlier allows attackers to trick authenticated users into performing unintended actions on the application, such as modifying bookings or changing settings, by exploiting lack of anti-CSRF tokens.

Exploitability

Exploitation requires social engineering to诱导 a logged-in user to click a malicious link or visit a crafted page; no authentication bypass or complex conditions are needed beyond user interaction.

Blast radius

Successful exploitation could lead to unauthorized data modification, account takeover via settings changes, or financial impact through fraudulent bookings, affecting both users and the rental business.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to VikRentCar version 1.4.9 or later, which includes proper CSRF token implementation for state-changing requests.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.