CVE-2010-1732: Cross-site request forgery (CSRF) vulnerability in the users module in Zikula Application Framework before...

Security readout for executives and security teams

CVE-2010-1732 is a CSRF issue in Zikula Application Framework before 1.2.3. If an administrator is logged in and is tricked into making a request, an attacker could change the administrator email address. That can affect control of the administrative account, but the sources do not show active exploitation. Exposure is most likely on Zikula Application Framework deployments older than 1.2.3, especially internet-facing sites with active administrator sessions. Organizations not running Zikula, or already on 1.2.3 or later, are not indicated as affected by the provided sources. Treat this as a targeted administrative account-control risk for legacy Zikula sites. Prioritize remediation if Zikula is still used for public or business-critical web properties, but do not escalate as actively exploited based on the supplied evidence. Mitigation focus: Upgrade Zikula Application Framework to 1.2.3 or later.; Review vendor release guidance for any additional security instructions.; Restrict administrative access to trusted networks where practical..

Prepared

Jun 28, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.