Object deletion via unverified cross-site requests

CSRF in Ampache 6.6.0 and earlier allows remote attackers to delete playlists or other objects through an authenticated user's browser. The playlist.php deletion action accepts an attacker-chosen playlist_id in a submitted form and processes the state-changing request without verifying an anti-CSRF token. Exploitation requires a victim with a valid Ampache session to load or submit the malicious form, and the resulting deletion is limited by that user's access.