CVE-2026-5791 is a Cross-Site Request Forgery (CSRF) vulnerability in DivvyDrive Information Technologies Inc.'s DivvyDrive product affecting versions from 4.8.2.9 before 4.8.3.2. The vulnerability allows attackers to perform unauthorized actions on behalf of authenticated users by exploiting the lack of proper CSRF protections. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed yet.

Successful exploitation of this CSRF vulnerability can lead to an attacker executing unauthorized commands with the privileges of an authenticated user, potentially resulting in full compromise of the affected system's confidentiality, integrity, and availability. Given the critical CVSS score, the impact is severe. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing compensating controls such as enforcing strict anti-CSRF tokens, validating the origin of requests, or limiting user privileges where possible. Monitor DivvyDrive vendor communications for updates and apply patches promptly once available.