Arbitrary actions via missing API CSRF protection

CSRF in the API of Teedy 1.12 and earlier allows remote attackers to make authenticated users perform arbitrary account and data changes. Most state-changing API routes accept cookie-authenticated cross-origin POST, PUT, and DELETE requests without validating a CSRF token, and the session cookie has no explicit SameSite attribute. Exploitation requires a logged-in user to visit an attacker-controlled page; routes that require the account password are excluded, and POST behavior depends on the victim's browser.