A Cross‑Site Request Forgery flaw exists within the Account Profile endpoint of Squidex CMS that lets a remote attacker leverage the victim's authenticated session to elevate privileges. The endpoint accepts requests without adequate anti‑forgery validation, allowing malicious actors to modify account settings or assign administrative roles. This directly compromises the integrity and confidentiality of the system by granting unauthorized users elevated access.

The vulnerability affects Squidex CMS version 7.21.0 and all earlier releases. No other vendors or products are listed as affected, and the problem is confined to the IdentityServer component of Squidex.

The EPSS score is not available and the issue is not listed in CISA KEV, but the nature of the flaw—CSRF with privilege escalation—indicates a high likelihood of exploitation against authenticated users. Attackers can craft a forged request that the victim’s browser will submit automatically, bypassing normal authorization checks. In the absence of a publicly released patch, the risk remains elevated until the software is updated or mitigated by additional controls.