The vulnerability occurs when an unauthenticated request can modify the CSRF exemption state of a protected endpoint in CKAN. This allows an attacker to bypass the CSRF protection on subsequent requests from the same server process, potentially enabling non‑authenticated malicious actions such as data updates or deletions. The weakness is a classic CSRF bypass, identified as CWE‑352, and it can compromise the integrity of data managed by CKAN.

CKAN from the community is affected. Versions prior to 2.10.10 and 2.11.5 are vulnerable, but the CVE data lacks a precise list of affected build identifiers. Administrators should verify if their CKAN installation runs any of these older releases.

With a CVSS score of 6.1 the vulnerability is considered moderate. The EPSS score is not available, and it is not listed in the CISA KEV catalog, indicating no confirmed public exploitation yet. An attacker can trigger the vulnerability by sending a simple unauthenticated HTTP request targeting a protected endpoint; once the endpoint is marked as exempt from CSRF protection for that server process, subsequent requests (even from other users) can be submitted without the required CSRF token. This makes the exploitation straightforward and potentially impactful if the endpoint performs sensitive operations.