CSRF to make any user accept the invitation to the team

How it was found

#Description: The victim can be tricked into accepting the invite as a normal GET request is sent while accepting the request.

#Steps to reproduce Make an html page using the following code:

<a href="https://liberapay.com/test/membership/accept">click here</a>

Change" test" with your team mate.

Impact

The impact is low but still it can make a user to accept the request even if he wanted not to.