{"id":"CVE-2026-100524","title":"Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation","summary":"Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to …","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cwe":["CWE-352"],"vendor":"Cotonti","product":"Cotonti","affected":["Cotonti <= 1.0.0"],"published":"2026-09-26","updated":"2026-09-26","sourceUpdated":"2026-09-26T01:17:01.167","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100524","references":[{"url":"https://github.com/Cotonti/Cotonti","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/blob/1.0.0/system/admin/admin.extensions.php","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/issues/1907","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/pull/1908","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-via-extensions-manager","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-26T01:24:36.887Z","slug":"CVE-2026-100524","body":"## Overview\n\nCotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause extensions by tricking them into visiting a malicious page while authenticated.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}