Gokapi में लॉगिन एंडपॉइंट में CSRF की समस्या है github.com/forceu/gokapi में

A successful CSRF attack against Gokapi's login endpoint could allow an attacker to impersonate a legitimate user and perform actions they are authorized to do. This could include modifying data, accessing sensitive information, or performing administrative tasks. The impact is amplified if the affected Gokapi instance is used in a critical business process or handles sensitive data. While the CVSS score is medium, the potential for unauthorized access and data manipulation warrants immediate attention. The attacker would need to trick a user into clicking a malicious link or visiting a crafted webpage, which could be achieved through phishing or cross-site scripting (XSS) vulnerabilities on other parts of the application.

Organizations using Gokapi in their backend systems, particularly those handling sensitive user data or providing critical services, are at risk. Applications relying on Gokapi's API for authentication and authorization are also vulnerable. Development teams using older versions of Gokapi should prioritize upgrading to the latest release.

• go / server: Inspect Gokapi application code for missing or improperly implemented CSRF protection on the login endpoint. Look for absence of CSRF tokens in request parameters or headers.

// Example: Check for CSRF token in request
if token == nil || !token.Valid() {
    return http.StatusBadRequest, errors.New("Invalid CSRF token")
}

• generic web: Monitor access logs for suspicious requests targeting the Gokapi login endpoint, particularly those originating from unusual IP addresses or user agents.

grep "/login" access.log | grep -v "127.0.0.1" | sort | uniq -c

• generic web: Use a web proxy (e.g., Burp Suite) to intercept and analyze requests to the Gokapi login endpoint, looking for missing CSRF tokens or other suspicious patterns.

1. 2026-03-10Disclosure

   disclosure

1. आरक्षित2026-03-03
2. प्रकाशित2026-03-10
3. संशोधित2026-03-23
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-29084 is to upgrade Gokapi to version 2.2.3 or later. This version includes the necessary fixes to prevent CSRF attacks on the login endpoint. If upgrading immediately is not feasible, consider implementing temporary workarounds such as adding CSRF tokens to all sensitive requests or implementing stricter input validation. Web Application Firewalls (WAFs) can be configured to detect and block suspicious CSRF requests. After upgrading, verify the fix by attempting to trigger a CSRF request using a tool like Burp Suite or OWASP ZAP and confirming that the request is rejected.