---
id: CVE-2026-64821
title: djangoSIGE 1.10 CSRF via GET-based Order Cancellation Views
summary: >-
  djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery
  vulnerability that allows unauthenticated attackers to cancel sales or
  purchase orders on behalf of authenticated users by exploiting
  order-cancellation logic…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-352
vendor: thiagopena
product: djangoSIGE
affected:
  - djangoSIGE <= 1.10
  - djangoSIGE <= a6fe7e8e3a7d52ba0a25305df4e5e7e0cd5f5792
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-22T14:49:45.798305Z'
exploitAvailable: true
published: '2026-07-21'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:07:58.549Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64821'
references:
  - url: >-
      https://github.com/americooo/pentest-writeups/tree/main/djangoSIGE-CVE-2026-64821-64822
    label: Researcher Disclosure
  - url: 'https://github.com/thiagopena/djangoSIGE/pull/163'
    label: Pull Request
  - url: >-
      https://www.vulncheck.com/advisories/djangosige-csrf-via-get-based-order-cancellation-views
tags:
  - cve.org
  - exploit-available
epss: 0.00222
epssPercentile: 0.12841
ingestedAt: '2026-11-08T14:51:22.270Z'
---

## Overview

djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, and CancelarPedidoCompraView. Attackers can lure an authenticated victim with change_orcamentovenda or equivalent permissions to a page containing a cross-origin reference such as an img tag pointing to the cancellation endpoint, bypassing CSRF token validation entirely since Django's CsrfViewMiddleware only enforces CSRF checks on unsafe HTTP methods.

## Affected

- `djangoSIGE <= 1.10`
- `djangoSIGE <= a6fe7e8e3a7d52ba0a25305df4e5e7e0cd5f5792`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.