Description

The /account/delete functionality is vulnerable to CSRF. In this way, an attacker can trick the victim to delete his own account just clicking on the link.

Steps to reproduce

• Login with a user
• Now go here: https://app.wallabag.it/account/delete
• The account is now deleted without any confirmation

Impact

An attacker can trick the victim to delete his own account just clicking on the link.

Remediation

Convert it to a POST request with CSRF token, or implement a CSRF token in the URL.