AIKIDO-2026-10320

TL;DR

Affected versions of this package expose the Deactivate Account action to Cross-Site Request Forgery (CSRF) because the operation was triggered via a simple GET link without CSRF protection. An attacker could craft a malicious webpage that silently issues a request to the porter/deactivate-account endpoint while a victim is authenticated, causing the victim’s account to be deactivated without their consent. By embedding the request in an image, link, or auto-submitting form, the attacker could trick users into visiting the page and unknowingly triggering the action. The patch mitigates this by requiring a POST request with a valid CSRF token.