Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Summary The MethodOverride middleware accepts any non-empty string as the override target method — including safe methods (GET, HEAD, OPTIONS, TRACE) — when rewriting a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain (e.Use()), it rewrites the request method to a safe method before CSRF evaluates it. The CSRF middleware then skips token validation for the now-safe method, allowing state-changing POST handlers to execute without any CSRF check. Both the legacy token path and the modern Sec-Fetch-Site protection path are bypassed simultaneously. Affected Component middleware/methodoverride.go — MethodOverrideConfig.ToMiddleware() (lines 55–71): no whitelist on the override target method middleware/csrf.go — CSRFConfig.ToMiddleware() (lines 188–189): safe-method bypass branch reads the already-rewritten method middleware/csrf.go — checkSecFetchSiteRequest() (line 283): Sec-Fetch-Site safe check also reads the rewritten method Description MethodOverride accepts safe methods as override targets MethodOverrideConfig.ToMiddleware() (methodoverride.go:55-71) restricts the source method (only POST requests are overrideable) but applies no…

curl https://cve.zerocrew.in/api/cve/CVE-2026-118266