CVE-2025-58833 describes a Cross-Site Request Forgery (CSRF) vulnerability in INVELITY Invelity MyGLS connect versions up to 1.1.1. The vulnerability enables object injection through CSRF attacks, allowing attackers to execute unauthorized commands or manipulate application state. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability with high severity. No official patch or mitigation details are currently available from the vendor.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability due to object injection via CSRF. This means attackers could potentially execute unauthorized actions on behalf of authenticated users, manipulate data, or disrupt service operations. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is currently documented, users should monitor vendor communications closely. Until a fix is available, consider implementing CSRF protections such as validating anti-CSRF tokens, restricting unsafe HTTP methods, and limiting user privileges where possible to reduce risk.