Overview

Cross-site request forgery(CSRF) vulnerability in Teedy versions <= v1.11 allows remote attackers to force an end user to change their user information(username, password, etc...) on the web application in which they're currently authenticated.

Vulnerability

Due to the lack of CSRF protection, it is possible to trick an authenticated user into performing an unwanted action such as changing user information.
Tricking an authenticated user into making a request to one of the endpoints can change user profile(including password) leading to account takeover.

Fix

To fix this vulnerability, implement CSRF token for endpoints.
CSRF token makes it difficult for an attacker to construct a valid request.
It must be unpredictable and secret.

References

sismics - Teedy(https://github.com/sismics/docs)
portswigger - Cross-site request forgery(CSRF)(https://portswigger.net/web-security/csrf)
Mozilla - Examples of access control scenarios(https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#examples_of_access_control_scenarios)

Credits

Thank you, Ayato for teaching me how to report a vulnerability.