Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.

Published Jul 7, 2019 · Updated Aug 4, 2024 · Assigned by mitre