Vulnerability · Published Jul 21, 2026 · Assigned by VulnCheck

CVE-2026-64821djangoSIGE 1.10 CSRF via GET-based Order Cancellation Views

Medium 4.3

In plain English

A medium-severity cross-site request forgery in djangoSIGE from thiagopena. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 87.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, and CancelarPedidoCompraView. Attackers can lure an authenticated victim with change_orcamentovenda or equivalent permissions to a page containing a cross-origin reference such as an img tag pointing to the cancellation endpoint, bypassing CSRF token validation entirely since Django's CsrfViewMiddleware only enforces CSRF checks on unsafe HTTP methods.

Affected products (as reported)

Vendor	Product	Versions
thiagopena	djangoSIGE	0 – through 1.100 – through a6fe7e8e3a7d52ba0a25305df4e5e7e0cd5f5792

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

Researcher Disclosure technical-description, exploit
Pull Request issue-tracking
https://www.vulncheck.com/advisories/djangosige-csrf-via-get-based-order-cancellation-views third-party-advisory