The vulnerability originates from state‑changing order cancellation views that process GET requests. Because the framework’s CSRF middleware checks tokens only on non‑GET methods, an unauthenticated attacker can cause an authenticated user to cancel sales or purchase orders by making the victim’s browser perform a GET request to the cancellation endpoint. The result is that an attacker can dispose of orders at will, potentially causing financial loss or disrupting business operations. The likely attack vector is a malicious webpage that embeds a reference to the cancellation URL (for example, in an <img> tag or iframe) and lures a legitimate user who has the necessary permissions to visit the page. When the user’s browser loads the referenced resource, the server processes the GET request and cancels the order without validating a CSRF token. There is no indication that local privilege escalation or remote code execution is required; the impact is limited to the ability to modify or delete data for which the victim is authenticated.

Affected are instances of the djangoSIGE application in version 1.10 and any earlier release that has not been updated past commit a6fe7e8. There is no other versioning information in the data, so any deployment of djangoSIGE built on that code base is considered vulnerable.

The CVSS score of 5.3 rates it as medium risk, reflecting the limited scope to data modification. The EPSS score of less than 1% indicates a very small exploitation probability at this time, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the attack does not require complex setup and can be triggered by a simple image tag, the risk to organizations that allow end users to view untrusted content is non‑negligible. The vulnerability is exploitable over the public internet by an attacker who can trick an authenticated user into loading a crafted page.