The vulnerability arises from overly permissive CORS settings that expose all unauthenticated endpoints to CSRF attacks. This allows an attacker to perform actions such as signing up for an account and creating projects on instances hosted locally on personal machines. The main risk is for instances that are not publicly accessible, as attackers could otherwise register directly by visiting the application.

An attacker hosts a malicious script on a server and convinces a user to visit the page. The script sends a POST request to the signup endpoint of the locally hosted instance of the software, creating a new user account and potentially gaining access to further actions if the token is exposed.

Users hosting instances of the software locally on their personal machines are affected. These instances are not publicly accessible, making them vulnerable to CSRF attacks through local network access.