Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| Kotti(PyPI) | 0 | 1.3.2 | N/A |
| Kotti(PyPI) | 2.0.0a1 | 2.0.0b2 | N/A |
CVSS Metrics
