Metasploit Project versions prior to 4.11.1 suffered from a cross site request forgery vulnerability in the initial user creation functionality.