Cross-Site Request Forgery Vulnerability in djangoSIGE Affected by Unauthorized Order Cancellation

CVE-2026-64821

What is CVE-2026-64821?

The djangoSIGE web application, up to version 1.10, contains a critical cross-site request forgery vulnerability that can be exploited by unauthenticated attackers. By cleverly crafting a link with a malicious cross-origin reference, attackers can manipulate authenticated users into canceling sales or purchase orders through vulnerable HTTP GET method handlers. This flaw arises because the CSRF validation is neglected in these handlers, allowing unauthorized actions to be executed without appropriate safeguards, compelling users with change permissions to unknowingly facilitate an attack.

References