EIP-2026-107507

This exploit demonstrates a CSRF vulnerability in Grocy <= 4.0.2, allowing an attacker to create a new user via a crafted HTML form if the victim is logged in with Create User Permissions. The PoC uses a hidden form submission to bypass CSRF protection.