CVE-2026-100524

MEDIUM 5.4

Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause extensions by tricking them into visiting a malicious page while authenticated.

CWE	CWE-352
Vendor	cotonti
Product	cotonti
Published	Sep 26, 2026

Stay Ahead of the Next One

Get instant alerts for cotonti cotonti

Be the first to know when new medium vulnerabilities affecting cotonti cotonti are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Affected Versions

Cotonti / Cotonti

0 ≤ 1.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Cotonti/Cotonti/issues/1907 github.com: https://github.com/Cotonti/Cotonti/pull/1908 github.com: https://github.com/Cotonti/Cotonti/blob/1.0.0/system/admin/admin.extensions.php github.com: https://github.com/Cotonti/Cotonti vulncheck.com: https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-via-extensions-manager

Credits

Harsh Raj Singhania