This vulnerability (CVE-2026-28172) is an unauthenticated Cross-Site Request Forgery (CSRF) issue in Tracking Code Manager software by Data443 Risk Mitigation, Inc. It affects versions up to 2.6.0. The flaw allows attackers to trick authenticated users into submitting unwanted requests, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed with low impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to induce a user to perform unintended actions within the Tracking Code Manager application, potentially leading to partial disclosure of information, modification of data, or disruption of service. The impact is limited by the need for user interaction and the scope of the affected application functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as anti-CSRF tokens and validating the origin of requests. Monitoring vendor communications for updates is recommended.