CVE-2026-18780: CWE-352 Cross-Site request forgery (CSRF) in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software

This vulnerability (CWE-352) in Talassoft Industrial Management Software allows an attacker to exploit CSRF to perform unauthorized state-changing requests on behalf of authenticated users. It affects versions starting from 4 up to but not including 16. The CVSS 3.1 vector indicates network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker can trick an authenticated user into submitting unauthorized requests, potentially leading to unauthorized modification of data or system state. The integrity of the system can be compromised, but confidentiality and availability impacts are low or none. The vulnerability can be exploited remotely without privileges but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing CSRF protections such as anti-CSRF tokens, validating the origin of requests, or restricting sensitive actions to POST requests with proper verification. Monitor vendor communications for updates.