CVE-2026-43985 Details

A cross-site request forgery (CSRF) vulnerability has been identified in Tautulli, a monitoring tool for Plex Media Server, in versions prior to 2.17.1. The issue arises because the 'configUpdate' endpoint, which allows state changes for administrators, does not enforce the POST method or implement anti-CSRF protections. In the default form and JWT-based authentication modes, the session cookie for administrators is set with 'SameSite=Lax', enabling top-level cross-site navigation requests. This vulnerability allows an attacker to lure a logged-in administrator into visiting a malicious page that sends a cross-site request to 'configUpdate', effectively overwriting the administrator's username and password. The attacker can then log in with the new credentials and gain full access to the Tautulli administrative interface.

Users can update to Tautulli version 2.17.1, which addresses this vulnerability by adding anti-CSRF tokens and requiring POST methods for state-changing endpoints.