CVE-2026-64821 Details

A cross-site request forgery (CSRF) vulnerability has been identified in djangoSIGE versions through 1.10 (commit a6fe7e8). This vulnerability allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users. The issue arises from order-cancellation logic implemented in HTTP GET method handlers within the 'CancelarOrcamentoVendaView', 'CancelarPedidoVendaView', 'CancelarOrcamentoCompraView', and 'CancelarPedidoCompraView'. Attackers can exploit this vulnerability by luring an authenticated user with the appropriate permissions to a page containing a cross-origin reference, such as an image tag pointing to the cancellation endpoint. This approach bypasses CSRF token validation entirely, as Django's CsrfViewMiddleware only enforces CSRF checks on unsafe HTTP methods, leaving GET requests unchecked.

The vulnerability can be fixed by moving the order cancellation logic from the GET method to the POST method, and updating the templates that reference these URLs to use a form with the POST method and include a CSRF token. A pull request with this fix has been submitted to the djangoSIGE repository.