In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13760
Reference (s):
- https://developer.joomla.org/security-centre/817-20200605-core-csrf-in-com-postinstall