CVE-2026-73847 in Emlog
Summary
by MITRE • 08/14/2026
Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute_tool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator. The authentication cookie set in include/lib/loginauth.php has no explicit SameSite attribute, enabling Chrome's temporary Lax+POST grace window. The query_database case passes attacker-controlled sql and confirm_code values to Ai::queryDatabase in include/service/ai.php; read queries need no confirmation, write queries accept the public confirm string, only the blog table is write-protected, and aliasing password as pwd_hash bypasses output redaction. A successful request can read every database table and write every table except blog, including changing the user table to take over an administrator account. No fixed version is available as of this review.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability exists in Emlog versions 2.6.26 and earlier, where the administrative AI Assistant functionality lacks proper cross-site request forgery protection mechanisms. The flaw specifically affects the execute_tool action within admin/ai.php, creating a pathway for remote unauthenticated attackers to manipulate administrative sessions through forged requests originating from attacker-controlled web pages. The vulnerability exploits the absence of an explicit SameSite attribute in authentication cookies managed by include/lib/loginauth.php, which allows Chrome's temporary Lax+POST grace window to be leveraged for session hijacking attacks. This cookie configuration creates a window of opportunity where authenticated administrative sessions can be manipulated without proper validation.
The technical implementation of this vulnerability involves the query_database case within the administrative interface, which processes attacker-controlled sql and confirm_code parameters directly passed to the Ai::queryDatabase function in include/service/ai.php. The system's security model permits read operations without requiring confirmation codes while allowing write operations to accept a public confirm string value. However, the security boundary is improperly enforced as only the blog table remains write-protected, leaving all other database tables vulnerable to manipulation. The vulnerability also includes a sophisticated bypass mechanism where the password field is aliased as pwd_hash in certain contexts, effectively circumventing output redaction measures that would normally prevent sensitive data exposure.
The operational impact of this vulnerability is severe and encompasses complete administrative takeover capabilities. Successful exploitation allows attackers to read every database table, write to every table except the protected blog table, and modify user account information to assume administrator privileges. This represents a critical privilege escalation vulnerability that can lead to full system compromise, data exfiltration, and persistent backdoor establishment within affected web environments. The lack of a fixed version at the time of analysis indicates prolonged exposure risk for organizations using vulnerable Emlog installations.
Organizations should implement immediate mitigations including deploying explicit SameSite cookie attributes to prevent cross-site request forgery attacks, implementing proper authentication token validation for administrative actions, and enforcing stricter access controls on database operations. The vulnerability aligns with CWE-352 (Cross-Site Request Forgery) and represents a significant weakness in the application's session management and input validation processes. From an ATT&CK perspective, this vulnerability maps to T1078 (Valid Accounts), T1566 (Phishing), and T1046 (Network Service Scanning) techniques, as it enables unauthorized access through compromised administrative sessions. The absence of a patched version underscores the need for immediate defensive measures including network segmentation, monitoring for suspicious administrative activities, and implementation of web application firewalls to detect and block malicious requests targeting this specific vulnerability pattern.