The DeepAI API endpoint for changing user email addresses lacks CSRF protection, enabling attackers to perform unauthorized email changes via crafted POST requests if a user is logged in and tricked into clicking a malicious link. This vulnerability is identified as CWE-352 and assigned CVE-2026-49433. It was publicly disclosed on 2026-06-01 with a low severity CVSS 4.0 score of 2.3. Although the description states the issue was fixed on 2026-05-20, no official patch or remediation advisory is provided in the data. The vulnerability affects the DeepAI api.deepai.org service but no specific affected versions are listed.

Successful exploitation allows an attacker to change the email address associated with a user's DeepAI account, potentially leading to account takeover. The impact is limited by the requirement that the user must be logged in and tricked into clicking a malicious link. The CVSS score of 2.3 reflects a low severity impact with partial user interaction and low confidentiality, integrity, and availability impact.

The description indicates the vulnerability was fixed on 2026-05-20, but no official vendor advisory or patch link is provided. Users and administrators should verify that their DeepAI API endpoints are updated to the fixed version released after this date. Since this is not a cloud service, remediation depends on applying the fix. Patch status is not yet confirmed from vendor advisory; check DeepAI's official communications for confirmation and update instructions.