The Drupal Fasttoggle module contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to change the publication status, promotion, and stickiness of nodes, as well as the publication status of comments. This occurs when a user with the "Use Fasttoggle" permission visits a malicious page while logged in. The vulnerability is mitigated by the requirement that the attacker must trick a user with this specific permission into visiting an attacker-controlled page. A fix is available in version 4.1.1.