This vulnerability (CWE-352) in Brevo's Newsletter, SMTP, Email marketing, and Subscribe forms by Sendinblue allows attackers to perform Cross-Site Request Forgery attacks. It affects versions up to 3.1.82. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction, with low complexity and limited impact on integrity only. No official patch or vendor advisory is currently available to confirm remediation status.

The vulnerability could allow attackers to trick authenticated users into submitting unauthorized requests, potentially altering email marketing or subscription settings. The impact is limited to integrity with no confidentiality or availability impact reported. No known exploitation in the wild has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens or other web application firewall rules where possible. Monitor official Brevo or Sendinblue communications for updates.