CVE-2024-56311: Vanderbilt Redcap

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into accessing a calendar event's notes, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.

Affected products

• Vanderbilt Redcap: up to and including 14.9.6

Published 2024-12-22. Last modified 2026-06-17.