CVE-2026-35096 describes a CSRF vulnerability in KTM System e-BOK affecting the email-change and password-change features. An attacker can exploit this by inducing an authenticated user to visit a malicious site that sends forged POST requests to the application, resulting in unauthorized changes to the user's credentials. The vulnerability was fixed by a patch published in June 2026. No specific affected versions were provided. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on integrity.

Successful exploitation allows an attacker to change the email address or password of an authenticated user without their knowledge or interaction, potentially leading to account takeover or denial of access for the legitimate user. The impact is rated medium with a CVSS score of 5.1, reflecting limited but significant risk.

A patch addressing this vulnerability was released in June 2026. Users and administrators should apply the official patch to remediate the issue. Since the vendor advisory or patch links are not explicitly provided, verify and obtain the patch from the official KTM System channels. No alternative mitigations or temporary fixes are indicated.