CVE-2026-70552

Summary

This vulnerability allows unauthenticated attackers to bypass authentication by manipulating the X-Requested-With header, gaining access to admin endpoints and performing actions such as manipulating poll states and vote counts.

Exploitability

Exploitation is relatively straightforward as it requires sending a specific HTTP request with a base64-encoded path. Attackers must have network access to the target system.

Blast radius

If exploited, this vulnerability could lead to unauthorized access to sensitive admin functionalities, potentially impacting the integrity and confidentiality of the application data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the AJAX dispatcher feature or restrict access to the affected endpoints by implementing proper authentication mechanisms.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.