CVE-2019-20780: 
NixOS vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in verydows that allows admin/users/new CSRF to create an admin account (group_id=1). The vulnerability was assigned CVE-2019-20780 and was disclosed on February 10, 2019 (CISA Bulletin).

The vulnerability has a CVSS score of 6.8, indicating a medium severity level. It specifically affects the admin user creation functionality in verydows, where the application fails to implement proper CSRF protections when creating new administrator accounts (CISA Bulletin).

The vulnerability allows attackers to create unauthorized administrator accounts through CSRF attacks. This could lead to complete compromise of the application's administrative functions and unauthorized access to sensitive administrative capabilities (CISA Bulletin).

The vulnerability can be exploited by crafting a malicious request that creates an admin account with group_id=1. The attack requires the target user to be authenticated as an administrator and to visit a malicious page while their session is active (CISA Bulletin).