Read the docs
TI-2022-13901 Aliases CVE-2022-32175GHSA-mwwc-3jv2-62j3

AdGuardHome - CSRF

Priority MEDIUM 58CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vulnerable to Cross-Site Request Forgery (CSRF), in the custom filtering rules functionality. An attacker can persuade an authorized user to follow a malicious link, resulting in deleting/modifying the custom filtering rules.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00337 27th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed github.com/AdguardTeam/AdGuardHome (Go): 0.108.0-b.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdguardHomeAdguardHomev0.99.0 and later; up to v0.108.0-b.9—No fix listedCNA
—github.com/AdguardTeam/AdGuardHome (Go)0.95 to before 0.108.0-b.160.108.0-b.16Patch availableGHSA-mwwc-3jv2-62j3
  • AdguardHome VendorAdguardHome Affected v0.99.0 and later; up to v0.108.0-b.9 Fixed in — No fix listed CNA
  • github.com/AdguardTeam/AdGuardHome (Go) Vendor— Affected 0.95 to before 0.108.0-b.16 Fixed in 0.108.0-b.16 Patch available GHSA-mwwc-3jv2-62j3

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:adguard:adguardhome:*:*:*:*:*:*:*:*0.95 to before 0.108VulnerableAdguard
cpe:2.3:a:adguard:adguardhome:0.108:-:*:*:*:*:*:*0.108VulnerableAdguard
cpe:2.3:a:adguard:adguardhome:0.108:beta1:*:*:*:*:*:*0.108 beta1VulnerableAdguard
cpe:2.3:a:adguard:adguardhome:0.108:beta10:*:*:*:*:*:*0.108 beta10VulnerableAdguard
cpe:2.3:a:adguard:adguardhome:0.108:beta11:*:*:*:*:*:*0.108 beta11VulnerableAdguard
cpe:2.3:a:adguard:adguardhome:0.108:beta12:*:*:*:*:*:*0.108 beta12VulnerableAdguard
cpe:2.3:a:adguard:adguardhome:0.108:beta2:*:*:*:*:*:*0.108 beta2VulnerableAdguard
cpe:2.3:a:adguard:adguardhome:0.108:beta3:*:*:*:*:*:*0.108 beta3VulnerableAdguard
cpe:2.3:a:adguard:adguardhome:0.108:beta4:*:*:*:*:*:*0.108 beta4VulnerableAdguard
cpe:2.3:a:adguard:adguardhome:0.108:beta5:*:*:*:*:*:*0.108 beta5VulnerableAdguard
  • cpe:2.3:a:adguard:adguardhome:*:*:*:*:*:*:*:* Versions 0.95 to before 0.108 Vulnerable ·Adguard
  • cpe:2.3:a:adguard:adguardhome:0.108:-:*:*:*:*:*:* Versions 0.108 Vulnerable ·Adguard
  • cpe:2.3:a:adguard:adguardhome:0.108:beta1:*:*:*:*:*:* Versions 0.108 beta1 Vulnerable ·Adguard
  • cpe:2.3:a:adguard:adguardhome:0.108:beta10:*:*:*:*:*:* Versions 0.108 beta10 Vulnerable ·Adguard
  • cpe:2.3:a:adguard:adguardhome:0.108:beta11:*:*:*:*:*:* Versions 0.108 beta11 Vulnerable ·Adguard
  • cpe:2.3:a:adguard:adguardhome:0.108:beta12:*:*:*:*:*:* Versions 0.108 beta12 Vulnerable ·Adguard
  • cpe:2.3:a:adguard:adguardhome:0.108:beta2:*:*:*:*:*:* Versions 0.108 beta2 Vulnerable ·Adguard
  • cpe:2.3:a:adguard:adguardhome:0.108:beta3:*:*:*:*:*:* Versions 0.108 beta3 Vulnerable ·Adguard
  • cpe:2.3:a:adguard:adguardhome:0.108:beta4:*:*:*:*:*:* Versions 0.108 beta4 Vulnerable ·Adguard
  • cpe:2.3:a:adguard:adguardhome:0.108:beta5:*:*:*:*:*:* Versions 0.108 beta5 Vulnerable ·Adguard
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:adguard:adguardhome:0.108:beta6:*:*:*:*:*:*0.108 beta6VulnerableAdguard
cpe:2.3:a:adguard:adguardhome:0.108:beta7:*:*:*:*:*:*0.108 beta7VulnerableAdguard
cpe:2.3:a:adguard:adguardhome:0.108:beta8:*:*:*:*:*:*0.108 beta8VulnerableAdguard
cpe:2.3:a:adguard:adguardhome:0.108:beta9:*:*:*:*:*:*0.108 beta9VulnerableAdguard
  • cpe:2.3:a:adguard:adguardhome:0.108:beta6:*:*:*:*:*:* Versions 0.108 beta6 Vulnerable ·Adguard
  • cpe:2.3:a:adguard:adguardhome:0.108:beta7:*:*:*:*:*:* Versions 0.108 beta7 Vulnerable ·Adguard
  • cpe:2.3:a:adguard:adguardhome:0.108:beta8:*:*:*:*:*:* Versions 0.108 beta8 Vulnerable ·Adguard
  • cpe:2.3:a:adguard:adguardhome:0.108:beta9:*:*:*:*:*:* Versions 0.108 beta9 Vulnerable ·Adguard

Remediation

  • Fix · GHSA-mwwc-3jv2-62j3 github.com/AdguardTeam/AdGuardHome (Go) Fixed in 0.108.0-b.16 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-32175
  2. 2026-10-03 Alias added: GHSA-mwwc-3jv2-62j3

References

Exploit 2

Advisory 1

Other 4

  • TI-2026-24673 AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2026-35206 AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences