Lektor EUVD-2026-91007

Requires the Lektor admin/edit server (the admin API blueprint, e.g. started via lektor server) to be actively running, and the operator to visit an attacker-controlled web page in a browser that can reach that server (UI:A). The admin API performs NO CSRF token, Origin/Referer, CORS, or Host allowlist validation, so no authentication or special configuration is needed to trigger the state-changing endpoints (newattachment, deleterecord, build, clean, publish). Limiting factors: exploitation depends on operator interaction (visiting the malicious page while the server is live), and because the admin server is normally bound to localhost/development use rather than exposed to the internet, the attacker reaches it through the victim's own browser; reaching READ endpoints to disclose data additionally requires a successful DNS rebinding attack, which is a materially harder precondition.

This is a CWE-352 CSRF flaw in Lektor's admin API, scored CVSS 4.0 7.0 (High). The vector (AV:N/AC:L/AT:N/PR:N/UI:A) is internally consistent with the description: the attack is browser-delivered (network), trivially reliable (low complexity), needs no authentication because the Lektor admin API itself ships with no CSRF token, Origin/Referer, CORS, or Host checks (PR:N), but does require an active victim - the operator must visit a malicious page while their admin server is running (UI:A). Impact is integrity- and availability-focused (VI:H/VA:H via arbitrary file write, page deletion, build-output wipe, and forced publish) with no direct confidentiality loss (VC:N) unless the attacker additionally pulls off DNS rebinding to reach read endpoints - a notably harder, multi-step precondition that should not be treated as baseline. The practical risk is bounded by deployment reality: Lektor's admin/edit server is typically a localhost development interface, not an internet-exposed production service, so a 'pure network' reading overstates reach - exploitation realistically targets a developer/operator's own machine via a drive-by page (UI:A is the real gating factor). No EPSS score and no KEV listing were provided, so there is no evidence of widespread or active exploitation; a public gist referenced in the advisory appears to be proof-of-concept material. Net: a legitimately exploitable, well-documented CSRF against an unauthenticated admin surface, but one whose real-world blast radius is limited by low product prevalence and the requirement to trick an operator while their local admin server is live.

A developer is running the Lektor admin/edit server locally (e.g. lektor server) and, in the same browser, visits an attacker-controlled web page. That page silently fires cross-origin requests to the admin API's newattachment, deleterecord, build, clean, or publish endpoints - which lack any CSRF token, Origin/Referer, CORS, or Host validation - causing arbitrary file writes, page deletion, build-output wiping, or a forced deployment publish without the operator's knowledge. A public gist referenced in the VulnCheck advisory appears to provide proof-of-concept exploit code, and via DNS rebinding the same technique can reach read endpoints to exfiltrate site data.