This vulnerability (CVE-2025-58833) in INVELITY Invelity MyGLS connect is a Cross-Site Request Forgery (CSRF) issue that enables object injection. It affects versions up to 1.1.1 and has a CVSS 3.1 base score of 8.8, indicating high impact with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability could allow an attacker to perform unauthorized actions on behalf of an authenticated user by exploiting CSRF, leading to potentially severe consequences.

Successful exploitation of this CSRF vulnerability can result in full compromise of the affected system's confidentiality, integrity, and availability. Attackers may inject objects or perform unauthorized actions without proper authorization, potentially leading to data breaches, system manipulation, or denial of service. The high CVSS score reflects the critical nature of these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided, organizations should monitor INVELITY's communications for updates. In the meantime, consider implementing CSRF protections such as anti-CSRF tokens, validating the origin of requests, and restricting actions to authenticated and authorized users to reduce risk.