GHSA-4j8w-p6hv-3qxc
Cross-Site Request Forgery (CSRF) in automad/automad
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | automad/automad | < 2.0.0-alpha.1 | 2.0.0-alpha.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
automad up to 1.10.9 does not implement anti-CSRF tokens by default, making it vulnerable Cross-Site Request Forgery (CSRF). An attacker may exploit this vulnerability to force an admin into creating or deleting users. An exploit has been disclosed publicly.
References
External links from the advisory. They lead to third-party sites.