This vulnerability is a Cross-Site Request Forgery (CSRF) issue in Smartsupp – live chat, chatbots, AI and lead generation software versions up to 3.6. CSRF vulnerabilities enable attackers to trick authenticated users into submitting unauthorized requests to the application, potentially altering data or state without the user's intention. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction. The impact is limited to integrity, with no confidentiality or availability impact reported. There is no vendor advisory or patch information available to confirm remediation status.

The vulnerability can allow attackers to perform unauthorized actions on behalf of authenticated users, potentially modifying data or application state (integrity impact). There is no reported impact on confidentiality or availability. No known exploits have been observed in the wild, reducing immediate risk. However, the medium severity score reflects the potential for misuse if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens in requests or restricting actions to trusted origins. Monitor vendor communications for updates on patches or official mitigations.