CVE-2026-55741: Cotonti CSRF in admin.config.php allows unauthorized configuration changes
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action ('a=update') processes POST data via cotconfigupdateoptions without calling cotcheckxg to validate the anti-CSRF token (the 'x' parameter), unlike other admin handlers (e.g. admin.structure.php, admin.cache.php).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify system/admin/admin.config.php so that when the configuration update action is invoked (a=update), it validates the anti-CSRF token by calling cot_check_xg for the 'x' parameter before processing POST data via cot_config_update_options.
Cotonti system/admin/admin.config.php (admin configuration handler) CSRF token validation = Require cot_check_xg ('x' parameter) for the configuration update action 'a=update'
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55741?
CVE-2026-55741 has a severity rating of high with a score of 8.8.
What vulnerability does CVE-2026-55741 describe?
CVE-2026-55741 describes a Cross-Site Request Forgery vulnerability in the admin configuration handler of Cotonti.
How do I fix CVE-2026-55741?
To fix CVE-2026-55741, ensure that cot_check_xg() is called to validate configuration update actions in the system/admin/admin.config.php file.
Who is affected by CVE-2026-55741?
CVE-2026-55741 affects users of Cotonti version 1.0.0 from the master branch, specifically commit f43f1fc3.
What impact does CVE-2026-55741 have on applications?
CVE-2026-55741 allows unauthorized configuration changes by exploiting Cross-Site Request Forgery in Cotonti applications.