This vulnerability in Quý Lê 91 Administrator Z allows CSRF attacks, where an attacker can trick an authenticated user into submitting unauthorized requests. The affected versions include all versions up to and including 2026.03.02. The CVSS vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The impact is limited to integrity loss without confidentiality or availability impact.

The vulnerability could allow an attacker to perform limited unauthorized actions on behalf of an authenticated user, potentially modifying data or settings. There is no direct confidentiality or availability impact reported. No known exploitation in the wild has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should consider implementing CSRF protections such as anti-CSRF tokens or same-site cookie attributes where possible. Monitor vendor channels for updates.