This vulnerability allows attackers to bypass the cross‑site request forgery protection in vtenext versions before 25.02.2 by sending state‑changing requests that are not POST. The vulnerability arises because the csrf_check() function in include/utils/VteCsrf.php skips validation of the __csrf_token parameter for any request method other than POST. Consequently, an attacker can trick a logged‑in user into visiting a crafted URL that triggers a GET request to a handler that interprets parameters from $_REQUEST. The handler then performs privileged actions using the victim’s credentials, resulting in an unauthorized change in the application state. The weakness is documented under CWE‑352.

The affected product is vtenext vtenext, and the vulnerability exists in all releases prior to version 25.02.2. Upgrading to version 25.02.2 or later resolves the issue.

The CVSS score for this issue is 6.9, indicating moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that public exploits are not widely reported. The likely attack path requires a victim who is authenticated to the system and is tricked into opening a malicious URL. The attacker can then forge a state‑changing request that the application accepts, potentially resulting in data modification, deletion, or other unauthorized actions under the victim’s authority.