Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100524Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager

Medium 5.4

In plain English

A medium-severity cross-site request forgery in Cotonti from Cotonti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.1%top 97.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause extensions by tricking them into visiting a malicious page while authenticated.

Affected products (as reported)

Vendor	Product	Versions
Cotonti	Cotonti	0 – through 1.0.0

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

References

https://github.com/Cotonti/Cotonti/issues/1907 issue-tracking
https://github.com/Cotonti/Cotonti/pull/1908 issue-tracking, patch
https://github.com/Cotonti/Cotonti/blob/1.0.0/system/admin/admin.extensions.php technical-description
https://github.com/Cotonti/Cotonti product
VulnCheck Advisory: Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager third-party-advisory