hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, potentially abusing latent credentials to upload packages or perform administrative actions. Some unauthenticated actions could also be exploited, such as creating new user accounts. This vulnerability affects the security of package uploads and administrative functions on the hackage server platform.