Cross-Site Request Forgery Vulnerability in Tautulli by Tautulli

CVE-2026-43985

What is CVE-2026-43985?

Tautulli, a monitoring tool for Plex Media Server, contains a vulnerability that allows attackers to exploit the 'configUpdate' endpoint. This security flaw stems from the lack of 'POST' enforcement and the absence of anti-CSRF tokens, making the endpoint exposed to unauthorized state changes. If a logged-in administrator is tricked into visiting a malicious site, the attacker can execute cross-site requests that modify the administrator's credentials. This can lead to unauthorized access to the Tautulli administrative interface. The vulnerability has been addressed in version 2.17.1, which provides the necessary security enhancements.

References