Dashboard takeover via tokenless administrator creation

CSRF in Flask Monitoring Dashboard 5.0.0 through 5.0.2 allows remote attackers to create an administrator through a victim session. The /api/user/create handler trusts the administrator session cookie and commits attacker-chosen credentials and the is_admin flag without validating a CSRF token or request origin. Exploitation requires an authenticated administrator to load attacker-controlled content, after which the new account grants persistent dashboard access and exposes monitored application data.