| Title | LinkStackOrg LinkStack v4.8.6 Cross-Site Request Forgery |
|---|
| Description | A cross-site request forgery issue affects LinkStack v4.8.6. The administrator route GET /admin/delete-user/{id} is registered in routes/web.php inside the auth, blocked, impersonate and admin middleware groups. It invokes AdminController::deleteUser(), which deletes all Link rows for the target user and then calls User::forceDelete(). The route accepts GET and does not require a CSRF token. The application includes VerifyCsrfToken in the web middleware group; Laravel's CSRF middleware does not require tokens for GET requests. Therefore a malicious site can induce a logged-in administrator to perform a top-level navigation to the deletion URL, using the administrator's session cookie, without knowing the CSRF token. The victim account and its links are permanently deleted. The same route file also contains GET state-changing operations for deleting an administrator-selected link, blocking/unblocking users, and changing email verification status. A POST alternative exists for bulk user deletion at /admin/delete-table-user/{id}, confirming that deletion does not need to be exposed as GET. The finding was verified against the v4.8.6 tag at commit dca586e8b8946a779cb212d21791cff6308fa7c0 using a read-only local source checker. No network request or destructive request was sent. Recommended fix: move state-changing routes to POST/PATCH/DELETE and enforce CSRF validation; add tests rejecting missing or invalid tokens. |
|---|
| Source | ⚠️ https://github.com/LinkStackOrg/LinkStack/blob/v4.8.6/routes/web.php#L165 |
|---|
| User | pure (UID 100805) |
|---|
| Submission | 09/23/2026 08:27 (1 month ago) |
|---|
| Moderation | 10/24/2026 23:21 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426136 [LinkStackOrg LinkStack up to 4.8.8 cross-site request forgery] |
|---|
| Points | 20 |
|---|