juice-shop multi-juicer up to 10.0.0 Team Join Endpoint /multi-juicer/api/teams cross-site request forgery

Summaryinfo

A vulnerability identified as problematic has been detected in juice-shop multi-juicer up to 10.0.0. This impacts an unknown function of the file /multi-juicer/api/teams of the component Team Join Endpoint. This manipulation causes cross-site request forgery. The identification of this vulnerability is CVE-2026-48518. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in juice-shop multi-juicer up to 10.0.0. It has been declared as problematic. Affected by this vulnerability is some unknown functionality of the file /multi-juicer/api/teams of the component Team Join Endpoint. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect integrity. The summary by CVE is:

MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances. In versions 8.0.0 through 10.0.0, the team join endpoint (POST /multi-juicer/api/teams/{team}/join) accepted requests with any Content-Type, including text/plain. Because that content type does not trigger a CORS preflight, an attacker could host a cross-site HTML form that auto-submits to the endpoint and forces a victim's browser to log in as the attacker's team. A successful, undetected attacker can cause victims to unwittingly solve Juice Shop challenges under the attacker's team identity. In a CTF context this lets the attacker inflate their team's score using other players' activity, and any sensitive data the victim enters into "their" Juice Shop ends up in the attacker's instance. The vulnerability is exploitable without any prior authentication; the victim only needs to visit a page the attacker controls while having network access to the MultiJuicer deployment. SameSite=Strict on the session cookie does not mitigate this, because the attack plants a new cookie rather than relying on an existing one. This issue was fixed in version 10.0.1.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-48518 since 05/21/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 10.0.1 eliminates this vulnerability. Applying the patch 75b08c3fdda410781d421bfdf041fb1e913d6b49 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• juice-shop

Name

• multi-juicer

Version

• 10.0

License

• open-source

Website

• Product: https://github.com/juice-shop/multi-juicer/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion