Critical
CVSS 9.1 Admin Panel Exposure Responsible Disclosure
Disclosure
Queue Manipulation via CSRF Token Extraction (Job Retry + Batch Retry)
POST endpoints on Horizon require CSRF token, but the token is freely obtainable from the Horizon page itself (which is unauthenticated). By first fetching the page to get session cookies + XSRF-TOKEN, then including the decoded XSRF-TOKEN in the X-XSRF-TOKEN header, all POST operations succeed. This enables
- Target
- EU Digital Goods Marketplace
- Category
- Admin Panel Exposure
- Channel
- Responsible Disclosure
- Disclosed
- 2026-03
Redaction note
Vendor identity withheld.
This finding is documented here as part of MemCyber’s public disclosure record. The vendor has been anonymized to a sector and region descriptor. Full technical detail — including root cause, reproducible proof-of-concept, remediation guidance, and vendor attribution where granted — is available to qualified prospects under NDA.
Coordinated disclosure
How we handled it.
- Reported to the vendor via Responsible Disclosure with a reproducible proof-of-concept.
- Triage + remediation window coordinated with the vendor security team.
- Fix verified before any public reference.
- This record published only after the embargo period closed.