CVE-2025-56798: Unraid OS CSRF Privilege Escalation Flaw

CVE-2025-56798 Overview

CVE-2025-56798 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Lime Technology's Unraid OS version 6.12.14 and earlier. The flaw stems from the Unraid authentication cookie using a LaxSameSite policy. Remote attackers can leverage this weak cookie policy to trick an authenticated administrator into issuing state-changing requests, resulting in privilege escalation on the Unraid server.

Exploitation requires an authenticated user to visit an attacker-controlled page while logged in to the Unraid web management interface. No credentials or user interaction beyond browsing are needed for the forged request to succeed.

Critical Impact
An attacker who lures an authenticated Unraid administrator to a malicious page can escalate privileges on the target system by forging authenticated web requests.

Affected Products

Lime Technology Unraid OS 6.12.14
Lime Technology Unraid OS versions prior to 6.12.14
Unraid web management interface using the vulnerable authentication cookie

Discovery Timeline

2026-08-26 - CVE-2025-56798 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2025-56798

Vulnerability Analysis

The vulnerability resides in how Unraid OS sets its authentication cookie. The cookie uses the SameSite=Lax attribute rather than SameSite=Strict. With the Lax policy, browsers attach the authentication cookie to top-level cross-site navigations, including form submissions using safe HTTP methods and framed navigations initiated by user clicks.

An attacker hosts a malicious page that triggers a request to the Unraid management interface. When an authenticated administrator visits the page, the browser sends the authentication cookie with the cross-site request. The Unraid backend treats the request as legitimate and performs the requested administrative action.

Because Unraid runs with elevated privileges on the storage server, forged requests can modify configuration, create administrative users, or otherwise escalate the attacker's control over the system. See the Insecure Blog Post and Unraid Security Research for additional technical context.

Root Cause

The root cause is an insufficient session cookie policy combined with missing anti-CSRF token validation on privileged endpoints. Setting SameSite=Lax allows cross-origin top-level requests to carry the session cookie, and the backend does not require a synchronizer token or origin check to confirm request provenance.

Attack Vector

Attack delivery is web-based. An attacker crafts a page that auto-submits a form or triggers a navigation to the Unraid web interface targeting a state-changing endpoint. The authenticated victim's browser attaches the session cookie, and the server executes the action under the victim's identity. Local network reachability to the Unraid host from the victim's browser is required, which is typical when administrators manage the appliance from their workstation.

No verified exploit code is published in the NVD record. Refer to the Unraid Blog CVD Overview for the vendor's coordinated disclosure position.

Detection Methods for CVE-2025-56798

Indicators of Compromise

Unexpected administrative account creation or role changes in the Unraid user database
Web server access logs showing state-changing POST requests with Referer or Origin headers pointing to external domains
Authentication cookie usage from browser sessions immediately after visits to unfamiliar external URLs

Detection Strategies

Inspect Unraid web server logs for privileged endpoint requests whose Origin or Referer header does not match the Unraid host
Correlate administrator browser history or proxy logs with subsequent configuration changes on the Unraid server
Alert on new administrative account creation and permission changes outside of scheduled maintenance windows

Monitoring Recommendations

Forward Unraid web interface access logs to a centralized log platform for retention and correlation
Monitor egress traffic from administrator workstations for connections to typosquatted or newly registered domains
Track configuration file changes on the Unraid appliance and generate alerts on unexpected modifications

How to Mitigate CVE-2025-56798

Immediate Actions Required

Upgrade Unraid OS to a version later than 6.12.14 once the vendor publishes a fixed release
Restrict access to the Unraid web management interface to a dedicated management VLAN or VPN
Instruct administrators to log out of the Unraid interface when finished and to avoid browsing untrusted sites in the same browser session

Patch Information

The NVD entry lists Unraid OS 6.12.14 and earlier as affected. Consult the Unraid Blog CVD Overview and vendor release notes for the specific fixed version and apply it as soon as it is available.

Workarounds

Use a dedicated browser profile solely for accessing the Unraid management interface to prevent cookies from being sent during general browsing
Place the Unraid web interface behind a reverse proxy that enforces Origin and Referer header validation for state-changing requests
Require multi-factor authentication in front of the Unraid web interface using a reverse proxy or identity-aware gateway

bash

# Example nginx snippet to reject cross-origin state-changing requests
# Place in front of the Unraid web interface
location / {
    if ($request_method = POST) {
        set $bad_origin 1;
        if ($http_origin ~* "^https?://unraid\.internal\.example\.com$") {
            set $bad_origin 0;
        }
        if ($bad_origin = 1) {
            return 403;
        }
    }
    proxy_pass http://unraid_backend;
}