The type_tray.favorites route is not protected against CSRF attacks.
The impact is pretty limited since it only allows adding/removing favorite bundles.
This was originally logged as a private issue to the security team, but was cleared to be moved to the public queue.
Send a GET request to http://example.com/type-tray/favorites-action/page/remove.
It does not require a CSRF token or a confirmation.
The route should use _csrf_token: 'TRUE'.
Active
1.3
Code
It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.
Issue #3511828: Protect type_tray.favorites route against CSRF attacks
Automatically closed - issue fixed for 2 weeks with no activity.