CVE-2026-81271: CWE-352 Cross-Site Request Forgery (CSRF) in Paolo GeoDirectory

This vulnerability, identified as CVE-2026-81271, is an unauthenticated Cross-Site Request Forgery (CSRF) issue in Paolo's GeoDirectory product affecting versions up to 2.8.176. The flaw enables attackers to induce users to execute unwanted actions without their consent, potentially compromising confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published as of the data provided.

Successful exploitation could allow attackers to perform unauthorized actions on behalf of users without their consent, leading to full compromise of confidentiality, integrity, and availability of the affected system. Given the unauthenticated nature, the attack surface is broad. However, no known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted content and consider implementing additional CSRF protections at the application or network level if feasible.