PatchSiren cyber security CVE debrief

CVE-2026-48518 juice-shop CVE debrief

CVE-2026-48518 is a medium-severity vulnerability in MultiJuicer, a tool for running separate Juice Shop instances on a central Kubernetes cluster. Versions 8.0.0 through 10.0.0 of MultiJuicer contain a cross-site request forgery (CSRF) vulnerability in the team join endpoint (POST /multi-juicer/api/teams/{team}/join). This endpoint accepted requests with any Content-Type, including text/plain, which does not trigger a CORS preflight. An attacker could exploit this by hosting a cross-site HTML form that auto-submits to the endpoint, forcing a victim's browser to log in as the attacker's team without prior authentication. The only requirement for exploitation is that the victim must visit a page controlled by the attacker while having network access to the MultiJuicer deployment. Successful exploitation allows an attacker to cause victims to unwittingly solve Juice Shop challenges under the attacker's team identity, potentially inflating their team's score in a CTF context. Additionally, any sensitive data entered by the victim into their Juice Shop instance ends up in the attacker's instance. The vulnerability was fixed in version 10.0.1.