This repository was archived by the owner on Jan 14, 2026. It is now read-only.
CSRF issue on preview pages
Package
No package listed
Affected versions
< 3.7.1
Patched versions
3.7.1
Description
Credits
-
staz0t Analyst
Impact
Bolt CMS lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could generate a preview.
Patches
This has been fixed in Bolt 3.7.1
References
Related issue: #7853