CVE-2026-64821
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
CSRF vulnerability in djangoSIGE up to version 1.10 allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users. The attack uses GET methods in cancellation views, bypassing CSRF protection.
Risk Assessment
Risk of unauthorized order cancellations, leading to financial loss and operational disruption.
Recommendation
Update djangoSIGE to the latest version and change cancellation methods to POST with proper CSRF protection.
Other vulnerabilities in djangoSIGE
Original NVD description (English source)
djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, and CancelarPedidoCompraView. Attackers can lure an authenticated victim with change_orcamentovenda or equivalent permissions to a page containing a cross-origin reference such as an img tag pointing to the cancellation endpoint, bypassing CSRF token validation entirely since Django's CsrfViewMiddleware only enforces CSRF checks on unsafe HTTP methods.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS