CVE-2026-73847 emlog CVE debrief

Who should care

Defenders responsible for Emlog installations, especially those using versions 2.6.26 and earlier, should assess exposure and prioritize remediation. System administrators and security teams should verify the vulnerability status of their Emlog installations and restrict access to the AI Assistant feature until a fix is available.

Why it matters

CVE-2026-73847 is a CSRF vulnerability in Emlog's AI Assistant feature that allows remote unauthenticated attackers to access and modify database tables. Defenders should prioritize verifying Emlog installations, restricting AI Assistant access, and implementing compensating controls until a fix is available.

• Potential database access and data theft.
• Possible administrator account takeover.
• Required verification of Emlog installations for exposure.
• Need for implementing compensating controls until a fix is available.

Technical summary

The Emlog AI Assistant feature in versions 2.6.26 and earlier has a CSRF vulnerability. This allows remote unauthenticated attackers to submit forged requests to recently logged-in administrators. The vulnerability can lead to reading and writing database tables, except for the blog table, and potentially allows an attacker to take over an administrator account. The query_database case passes attacker-controlled sql and confirm_code values to Ai::queryDatabase in include/service/ai.php; read queries need no confirmation, write queries accept the public confirm string, only the blog table is write-protected, and aliasing password as pwd_hash bypasses output redaction. A successful request can read every database

Defensive priority

Defenders should prioritize verifying Emlog installations, especially versions 2.6.26 and earlier, and restrict AI Assistant access.

Recommended defensive actions

• Verify Emlog installations, especially versions 2.6.26 and earlier, for vulnerability exposure.
• Restrict access to the AI Assistant feature.
• Implement CSRF protection for the AI Assistant execute_tool action.
• Monitor for suspicious activity related to the AI Assistant.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the CSRF vulnerability in Emlog's AI Assistant. The vulnerability allows remote unauthenticated attackers to submit forged requests to recently logged-in administrators, potentially leading to database access and administrator account takeover.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.