Cross-Site Request Forgery Vulnerability in Sync Breeze and Disk Pulse by Flexense

CVE-2025-59894

What is CVE-2025-59894?

A cross-site request forgery vulnerability exists in Sync Breeze Enterprise Server and Disk Pulse Enterprise, allowing an authenticated user to manipulate other users' sessions. This occurs due to an inadequate implementation of CSRF tokens, enabling malicious actions such as executing a POST request to delete all commands using a specific endpoint. Organizations utilizing these products should assess their exposure and implement appropriate mitigations to safeguard against potential exploitation.

References