Read the docs
TI-2025-20571 Aliases CVE-2025-27792

Opal vulnerable to CSRF protection bypass

Priority HIGH 73CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Tampering
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, the protections against cross-site request forgery (CSRF) were insufficient application-wide. The referrer header is checked, and if it is invalid, the server returns 403. However, the referrer header can be dropped from CSRF requests using `<meta name="referrer" content="never">`, effectively bypassing this protection. Version 5.1.1 contains a patch for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00291 21st percentileScored 2026-11-07
Fix Fixed opal (obiba): 5.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
obibaopalbefore 5.1.15.1.1Patch availableCNA
  • opal Vendorobiba Affected before 5.1.1 Fixed in 5.1.1 Patch available CNA

Remediation

  • Fix · CNA opal (obiba) Fixed in 5.1.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27792

References

Other 1

  • TI-2025-19972 Agate vulnerable to HTML injection in user signup - Administrator phishing risk CVSS 4.0MEDIUM 5.4
  • TI-2025-19971 Broken Access Control in Opal filesystem's copy functionality exposes all user data CVSS 4.0HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences