CVE-2026-14800 describes a cross-site request forgery (CSRF) vulnerability in the imhamzaazam ecommerceFlask project affecting all code up to commit cb7d9e24c30a99379651b7493b32048126ef402b. The vulnerability arises from an unspecified function that does not properly protect against CSRF attacks, allowing remote attackers to trick authenticated users into submitting unwanted requests. The project follows a rolling release model, so no discrete version numbers are available. The vulnerability was disclosed publicly, but the vendor has not yet provided a patch or official remediation guidance.

Successful exploitation of this CSRF vulnerability could allow remote attackers to induce authenticated users to perform unintended actions on the ecommerceFlask application. This could lead to unauthorized state changes or transactions within the application. The CVSS 4.0 base score of 5.3 (medium severity) reflects the network attack vector, low attack complexity, no privileges required, and user interaction required, with limited impact on confidentiality and integrity and no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor the project repository for updates. In the meantime, implementing standard CSRF protections such as anti-CSRF tokens and validating the origin of requests may help mitigate risk.