This vulnerability exists in the Photos application of Webasyst Framework versions up to 4.4.0. The Photos app does not enable the framework’s optional CSRF protection, allowing authenticated users to be tricked into submitting POST requests that perform backend operations such as deleting photos, saving albums, managing access, and updating photo fields. Because the requests are authenticated, an attacker can delete content, alter access rights, or otherwise tamper with user data without permission. The weakness is a classic cross‑site request forgery (CWE-352) that allows remote attackers to execute arbitrary state‑changing actions on behalf of logged‑in users.

The affected product is the Webasyst Framework, specifically the Photos app, in all releases through version 4.4.0. Users running these versions—any deployment that has not been updated to the latest release—could be impacted. No specific components beyond the Photos app are mentioned as affected.

The CVSS base score is 7.1, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Because the flaw requires a victim to be logged into the Photos app and to visit a malicious page, the attack vector is largely remote through social engineering or phishing. A successful exploitation would allow an attacker to perform actions as an authorized user, potentially deleting photos or changing visibility settings, which can compromise data integrity and privacy. The default configuration at the time of discovery disabled CSRF checks, enabling the exploit; enabling the framework’s CSRF protection would mitigate the risk.