AIncient Labs, home

Console request forgery and chat thread ownership

Atelier 0.26.0 requires a session token on every console action that changes something, and lets only a thread's owner use that thread or answer its approval prompts.

ATELIER-SA-2026-006 ·

Severity
Moderate
Affected
Atelier < 0.26.0
Fixed in
Atelier 0.26.0

Atelier 0.26.0 fixes two weaknesses in the console. 0.25.0 and earlier are affected. Both need a signed-in user to be involved, so a site with a single person signing in is at low risk; a site with several editors should update promptly.

What is fixed

  • Cross-site request forgery. The console's actions that change something (chat, page and media edits, studio saves) relied only on the session cookie's SameSite=Lax rule. A page on another site under the same domain could make a signed-in user's browser trigger one. Every such action now requires Drupal's per-session X-CSRF-Token header, which the console sends for you.
  • Chat thread ownership. A signed-in user who knew another user's thread id could post into that conversation or answer an approval prompt it raised. Threads and their approval prompts now answer only to their owner, from that thread.

What to do

  • Update to 0.26.0. With the Atelier Manager, run atelier app update. Installed with the install script, re-run the installer as described in Upgrade.
  • Scripts that call the console's routes with HTTP Basic authentication are unaffected. A script that uses a browser session cookie must fetch /session/token and send it as X-CSRF-Token.