Requirement 13 states:

The file changes.csv MUST contain the filename as well as the value of /document/tracking/current_release_date for each CSAF document in the sub-directories without a heading; lines MUST be sorted by the current_release_date timestamp with the latest one first.

Currently, the only checks performed are whether the date is valid and whether the lines are sorted. However, there is no check being made on whether the date corresponds to the respective /document/tracking/current_release_date.

This allows for completely arbitrary dates to be entered as long as they conform to the syntax.

To recreate, create a changes.csv and add an entry, inputting a wrong date.