We find that Pachno 1.0.6 lacks CSRF protection on several state‑changing endpoints, enabling attackers to execute arbitrary actions within the context of an authenticated user. By sending forged requests from an attacker‑controlled site, an attacker can trigger logouts, create new accounts, alter user roles, inject comments, or upload files. This can compromise the integrity and availability of the system, potentially allowing unauthorized configuration changes or malicious content to be introduced.

The vulnerability affects the Pachno project‑management application version 1.0.6 from vendor pancho, specifically the endpoints responsible for login, registration, file upload, milestone editing, and administrative functions. No other versions or products are listed as affected by the CNA record.

CVSS base score is 5.3, indicating a moderate risk. EPSS data is missing, and the vulnerability is not listed in CISA's KEV catalog, suggesting it has not yet been widely exploited in the wild. The likely attack vector is a cross‑site forgery where an infected website sends concealed HTTP requests to the target application. Because the credentials are not required for the request, any authenticated user who visits a malicious site could be coerced into performing unintended actions.