{"id":"CVE-2026-64821","title":"djangoSIGE 1.10 CSRF via GET-based Order Cancellation Views","summary":"djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-352"],"vendor":"thiagopena","product":"djangoSIGE","affected":["djangoSIGE <= 1.10","djangoSIGE <= a6fe7e8e3a7d52ba0a25305df4e5e7e0cd5f5792"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-22T14:49:45.798305Z"},"exploitAvailable":true,"published":"2026-07-21","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:07:58.549Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64821","references":[{"url":"https://github.com/americooo/pentest-writeups/tree/main/djangoSIGE-CVE-2026-64821-64822","label":"Researcher Disclosure"},{"url":"https://github.com/thiagopena/djangoSIGE/pull/163","label":"Pull Request"},{"url":"https://www.vulncheck.com/advisories/djangosige-csrf-via-get-based-order-cancellation-views"}],"tags":["cve.org","exploit-available"],"epss":0.00222,"epssPercentile":0.12841,"ingestedAt":"2026-11-08T14:51:22.270Z","slug":"CVE-2026-64821","body":"## Overview\n\ndjangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, and CancelarPedidoCompraView. Attackers can lure an authenticated victim with change_orcamentovenda or equivalent permissions to a page containing a cross-origin reference such as an img tag pointing to the cancellation endpoint, bypassing CSRF token validation entirely since Django's CsrfViewMiddleware only enforces CSRF checks on unsafe HTTP methods.\n\n## Affected\n\n- `djangoSIGE <= 1.10`\n- `djangoSIGE <= a6fe7e8e3a7d52ba0a25305df4e5e7e0cd5f5792`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}