The Europe Ecologie Les Verts EELV Newsletter software contains a CSRF vulnerability in versions up to 4.8.2. This vulnerability enables attackers to perform unauthorized actions on behalf of authenticated users by exploiting the lack of proper request validation. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Successful exploitation of this CSRF vulnerability could allow an attacker to induce authenticated users to perform unintended actions, potentially leading to limited integrity and availability impacts on the affected system. There is no confidentiality impact reported. No known exploits in the wild have been documented to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing standard CSRF mitigations such as verifying anti-CSRF tokens in requests or limiting user privileges to reduce potential impact. Monitor vendor channels for updates and apply patches promptly once available.