IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a Cross-Site Request Forgery (CWE-352) vulnerability due to improper request validation. This flaw could enable a remote attacker to trick an authenticated user into submitting unauthorized requests, potentially leading to the disclosure of sensitive information. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability.

The vulnerability allows remote attackers to obtain sensitive information by exploiting improper request validation, impacting confidentiality and integrity. There is no indication of privilege escalation or denial of service impact. No active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should follow IBM's security recommendations and consider mitigating CSRF risks through application-level controls such as validating request origins and using anti-CSRF tokens where applicable.