The administrator API blueprint in Lektor 3.3.14 and 3.4.0b15 lacks CSRF protection, allowing unauthenticated users to trigger state‑changing operations such as uploading arbitrary files, deleting content, wiping build directories, and publishing deployments from a malicious web page. The API accepts requests without CSRF tokens, Origin/Referer checks, CORS configuration, or host allowlisting, enabling an attacker to manipulate site data without credentials.

Deployments running Lektor version 3.3.14 or 3.4.0b15 are affected. No other released versions are specified as vulnerable.

The CVSS score of 7 indicates high severity. EPSS score is unavailable and the vulnerability is not listed in CISA KEV, but the lack of CSRF safeguards means any victim who visits a malicious page can forge requests to the administrator API. Exploitation requires no additional authentication and can result in unauthorized file writes, content deletion, build output erasure, deployment publication, and data disclosure via DNS rebinding, threatening confidentiality, integrity, and availability.