CVE-2026-49433CWE-352

DeepAI api.deepai.org/change_user_email CSRF

Low · published June 1, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

The DeepAI endpoint 'https://api.deepai.org/change_user_email' accepts POST requests without any CSRF protection. If an attacker can trick a logged-in user into clicking a malicious link, the attacker can change the user's email address and take over their account. Fixed on 2026-05-20.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00158 · 4.6th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-06-01T19:59Z
EPSS history
Timeline
  • 01 JUN 19:59Z
    DeepAI api.deepai.org/change_user_email CSRF
    cvelistv5