Threats tagged 'ghsa-2wjc-h33p-6wrr'

Omnispace Agora Project versions through 26.10.0 have a cross-site request forgery (CSRF) vulnerability. This flaw allows remote attackers to perform privileged actions, such as creating administrator users, by exploiting the merging of $_GET and $_POST parameters without requiring an anti-CSRF token. The vulnerability leverages the absence of CSRF protection combined with SameSite=Lax cookie behavior on top-level navigations, enabling attackers to craft malicious links or auto-navigating pages that issue GET requests to execute unauthorized actions.