CVE-2026-100524: Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager
Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause extensions by tricking them into visiting a malicious page while authenticated.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Administrators authenticated to a Cotonti instance are the relevant targets, because the affected actions are performed through the Extensions Manager using their existing session.
What must an attacker do to exploit it?
An attacker must cause an authenticated administrator to visit a malicious page, link, or embedded-image request. No attacker authentication is required, but user interaction is required.
Which actions can be forced through the vulnerable endpoint?
The issue can be used to trigger extension installation, updates, pausing, or unpausing without anti-CSRF token validation.