Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.