CVE-2025-54035 is a CSRF vulnerability affecting Tribulant Software Newsletters (newsletters-lite) versions up to 4.10. The vulnerability allows an attacker to trick authenticated users into submitting unauthorized requests, potentially causing limited integrity impact. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction. No known exploits are reported in the wild, and no official patch or vendor advisory is provided at this time.

The vulnerability could allow an attacker to perform unauthorized actions on behalf of an authenticated user, potentially altering newsletter settings or subscriptions. There is no impact on confidentiality or availability reported. The overall impact is limited to integrity with medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying anti-CSRF tokens or restricting actions to trusted users. Monitor vendor channels for updates.