CVE-2006-5878

Edgewall Trac Cross-site request forgery (CSRF) vulnerability

7.5 HighFix available

Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors.

Exploit likelihood

2.20%Up 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors.

Record: CVE-2006-5878
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors.

Record: CVE-2006-5878
Updated: 2026-11-02

EUVDEUVD-2006-0005 No score

Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors.

Record: EUVD-2006-0005
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2q26-r8c4-jfx5 8.7

Edgewall Trac Cross-site request forgery (CSRF) vulnerability

Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors.

Record: GHSA-2q26-r8c4-jfx5
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-352
Updated: 2026-11-02

OSVGHSA-2q26-r8c4-jfx5 8.7

Edgewall Trac Cross-site request forgery (CSRF) vulnerability

Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors.

Record: GHSA-2q26-r8c4-jfx5
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-352
Updated: 2026-11-02

OSV No score

Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors.

Record: CVE-2006-5878
Updated: 2026-11-02

OSVDEBIAN-CVE-2006-5878 No score

Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors.

Record: DEBIAN-CVE-2006-5878
Updated: 2026-11-02

OSVPYSEC-2006-3 No score

Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors.

Record: PYSEC-2006-3
Updated: 2026-11-02

Affected products

edgewall software trac

Affected packages

Affected packages
Package	Affected	Fixed
`trac` PyPI	before 0.10.1	0.10.1
`trac` Debian:13	before 0.10.1-1	0.10.1-1
`trac` Debian:14	before 0.10.1-1	0.10.1-1
`trac` Debian:3.1	before 0.8.1-3sarge6, plus listed versions 0.8.1-30.8.1-3sarge10.8.1-3sarge20.8.1-3sarge30.8.1-3sarge40.8.1-3sarge5	0.8.1-3sarge6
`trac` PyPI	before 0.10.1, plus listed versions 0.100.8.40.9	0.10.1
`trac` PyPI	before 0.11, plus listed versions 0.100.8.40.9	0.11

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-5878 is a high vulnerability (CVSS 7.5) in Edgewall Software Trac, published November 12, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.20%, the 82nd percentile. Fixed in trac 0.10.1.

References

Show 10 moreShow less