This vulnerability in LWS Affiliation (<= 2.3.6) allows CSRF attacks, where an attacker can induce a user to perform unwanted actions on the application without their consent. The vulnerability does not require privileges and has a low complexity to exploit, but user interaction is required. The impact is limited to integrity, with no confidentiality or availability impact reported.

The vulnerability could allow an attacker to perform unauthorized actions on behalf of an authenticated user, potentially altering data or settings within the LWS Affiliation application. There is no impact on confidentiality or availability. No known exploits have been reported, and the overall severity is medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens or other application-level mitigations if possible.