This vulnerability is a CWE-352 Cross-Site Request Forgery issue in Uploadcare File Uploader and Adaptive Delivery (beta) affecting versions through 3.0.11. It enables attackers to trick authenticated users into submitting unauthorized requests. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. No patch or official remediation level has been disclosed, and the product is not a cloud service, so remediation depends on vendor updates.

The impact is limited to potential unauthorized actions performed by a user due to CSRF, with no direct confidentiality or availability compromise. The integrity impact is low, meaning attackers might cause limited unauthorized changes or actions within the affected Uploadcare components. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing CSRF protections such as verifying origin headers or using anti-CSRF tokens if possible within their integration. Monitor vendor communications for updates on official patches or mitigations.