Low Severity
CVE-2026-107084
Published: Oct 27, 2026
CSRF in SLiMS 9.8.0 loan history maintenance allowing unauthorized data loss (TRUNCATE). CVE-2026-107084.
# CVE-2026-107084 — Cross-Site Request Forgery (CSRF) in SLiMS 9.8.0 Loan History Maintenance
## Summary
SLiMS 9.8.0 allows **Cross-Site Request Forgery (CSRF)** against `admin/modules/circulation/loan_history_maintenance.php`. The `action=run` GET parameter performs privileged, destructive operations — specifically the `TRUNCATE` of the `loan_history` table (via `task=empty` or `task=rebuild_all`). This action is executed with **no CSRF token** and **no POST confirmation**.
Because SLiMS does not set the `SameSite` attribute on the admin session cookie, a top-level GET navigation (e.g., an admin clicking a crafted link or being redirected to the URL) still carries the session cookie. A cross-site `<img>` fetch would be blocked from carrying the cookie by `SameSite=Lax`, but the navigation vector still applies.
**Impact:** An authenticated admin can be tricked into triggering a destructive GET request, resulting in **Data Loss** (complete truncation of loan history records).
| Field | Value |
|-------|-------|
| CVE ID | CVE-2026-107084 |
| Official Record | [cve.org/CVERecord?id=CVE-2026-107084](https://www.cve.org/CVERecord?id=CVE-2026-107084) |
| Affected Version | SLiMS 9.8.0 (master) |
| Vulnerability Type | CWE-352: Cross-Site Request Forgery (CSRF) |
| Attack Vector | Network |
| Privileges Required | None (Requires user interaction by an authenticated admin) |
| Affected Component | `admin/modules/circulation/loan_history_maintenance.php` (`action=run`, tasks `empty`, `rebuild_all`) |
| Original Report | [slims/slims9_bulian#394](https://github.com/slims/slims9_bulian/issues/394) |
---
## Affected Files
| File | Vulnerable Lines |
|------|------------------|
| `admin/modules/circulation/loan_history_