Franklioxygen

An issue exists where the `shouldSkipCsrfProtection()` function in `backend/src/middleware/csrfConfig.ts` delegates to `isApiKeyRequest()`, which grants a Cross-Site Request Forgery (CSRF) exemption based solely on the presence of an `x-api-key` header or an `Authorization: ApiKey` value, without performing actual API-key validation. When a permissive `CORS ALLOWED ORIGINS` configuration is used, an unauthenticated attacker can trick an authenticated administrator into visiting malicious content. This allows the attacker to send cross-origin state-changing requests using an arbitrary API-key value. Because the victim's session cookie authenticates the request and CSRF validation is bypassed, the attacker can perform administrative operations such as deleting media, triggering downloads, or modifying subscriptions.

When `statisticsEnabled` and `statisticsTrackVisitorActivity` are enabled, a user with a visitor role can submit fabricated events to the statistics ingest endpoint handled by the `ingestEvents()` function in `backend/src/controllers/statisticsController.ts`. The handler processes `req.body.events` and accepts the `platform`, `sourceKind`, and `sessionId` variables without server-side validation. This allows a visitor to attribute fake events to arbitrary platforms, sources, and sessions, which corrupts administrator-visible view counts, download counts, platform breakdowns, source attribution, and session analytics.