High severityOSV Advisory· Published Mar 11, 2025· Updated Apr 15, 2026
CVE-2025-27792
CVE-2025-27792
Description
Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, the protections against cross-site request forgery (CSRF) were insufficient application-wide. The referrer header is checked, and if it is invalid, the server returns 403. However, the referrer header can be dropped from CSRF requests using <meta name="referrer" content="never">, effectively bypassing this protection. Version 5.1.1 contains a patch for the issue.
Affected products
1Patches
1cd7da94135a3Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.