Language: PHP
Label: vulnerable
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
    public function __construct(RestApi $jira, string $templateName, $fieldId = null)
    {
        $this->jira = $jira;
        $this->fields = $this->enumAllowedFields();

        $this->templateConfig = Config::module('jira', 'templates');

        $this->templateName = $templateName;

        if ($fieldId !== null) {
            if (! array_key_exists($fieldId, $this->fields)) {
                $this->fieldId = array_search($fieldId, $this->fields);
            } else {
                $this->fieldId = $fieldId;
            }

            $templateFields = $this->templateConfig->getSection($templateName)->toArray();

            $this->fieldValue = $templateFields[$fieldId];
        }
    }