CVE-2026-100524: Cotonti Extensions Manager CSRF Vulnerability

CVE-2026-100524 Overview

Cotonti through version 1.0.0 contains a cross-site request forgery (CSRF) vulnerability in the extensions manager component. The flaw resides in system/admin/admin.extensions.php, which performs state-changing actions without validating an anti-CSRF token. An attacker can craft a malicious link or embed an image that triggers requests to install, update, pause, or unpause extensions. If an authenticated administrator visits the attacker-controlled page, the browser submits the forged request using the administrator's session. This vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Authenticated administrators tricked into visiting a malicious page can be forced to install or modify Cotonti extensions, enabling attacker-controlled code to be loaded into the CMS.

Affected Products

Cotonti CMS versions through 1.0.0
The admin.extensions.php administrative module
Any Cotonti deployment where administrators have active authenticated sessions

Discovery Timeline

2026-09-26 - CVE-2026-100524 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100524

Vulnerability Analysis

The Cotonti extensions manager accepts administrative actions through HTTP requests that lack server-side anti-CSRF token validation. Administrative endpoints such as install, update, pause, and unpause are reachable using only session cookies to establish identity. Browsers automatically attach those cookies to any cross-origin request, so a request originating from an attacker-controlled page is treated as legitimate.

Because the vulnerable actions manage extensions, an attacker can leverage the forged request to introduce or modify code paths executed by the CMS. The attack requires an authenticated administrator and user interaction, such as clicking a link or loading a page that references the vulnerable endpoint. Full technical context is documented in the VulnCheck Cotonti CSRF Advisory and in Cotonti issue #1907.

Root Cause

The root cause is missing CSRF protection on state-changing requests handled by admin.extensions.php. The handler does not generate or verify a per-session, per-request token tied to the submitting form. Reliance on ambient session authentication alone is insufficient to prove request intent.

Attack Vector

An attacker hosts a page that issues HTTP requests to the Cotonti extensions manager, for example by embedding <img> tags or auto-submitting forms targeting the vulnerable action URLs. The attacker then lures an authenticated administrator to the page through phishing, forum posts, or malvertising. When the administrator loads the page, the browser forwards the session cookie, and Cotonti executes the extension action as if the administrator initiated it. See Cotonti pull request #1908 for upstream remediation details.

Detection Methods for CVE-2026-100524

Indicators of Compromise

Unexpected entries in extension install, update, pause, or unpause logs for the Cotonti admin area
HTTP referer headers on admin.extensions.php requests pointing to external or untrusted origins
New or modified files in the Cotonti extensions directory outside planned maintenance windows
Administrator sessions issuing extension-management actions immediately after visiting external links

Detection Strategies

Review webserver access logs for GET or POST requests to admin.extensions.php with suspicious Referer values or missing Origin headers
Alert on administrative actions performed outside documented change windows or by sessions with abnormal User-Agent strings
Correlate CMS audit logs with endpoint telemetry to identify administrators browsing untrusted sites moments before extension changes

Monitoring Recommendations

Enable verbose logging on the Cotonti admin interface, including request source, action name, and originating session
Monitor file integrity for the extensions directory and alert on unplanned additions or modifications
Track administrative account activity for extension-management operations and require a second-channel confirmation for high-risk changes

How to Mitigate CVE-2026-100524

Immediate Actions Required

Restrict access to the Cotonti admin interface to trusted networks or VPN endpoints only
Require administrators to use dedicated browser profiles or isolated sessions when accessing admin.extensions.php
Audit installed extensions and roll back any additions or updates that cannot be attributed to planned changes
Apply the upstream fix referenced in Cotonti pull request #1908 once incorporated into a released build

Patch Information

At the time of publication, Cotonti version 1.0.0 and earlier are affected. Remediation is tracked in Cotonti issue #1907 and Cotonti pull request #1908, which introduce anti-CSRF token validation on extension-management actions. Administrators should monitor the Cotonti GitHub repository for the fixed release and upgrade promptly.

Workarounds

Enforce a strict SameSite=Strict or SameSite=Lax attribute on the Cotonti session cookie to block cross-origin cookie attachment
Place the admin interface behind an authenticating reverse proxy or IP allowlist to prevent cross-site request reach
Instruct administrators to log out of the Cotonti admin console before browsing untrusted content
Deploy a Web Application Firewall rule that rejects requests to admin.extensions.php lacking an expected Origin or Referer header

bash

# Example nginx snippet to restrict admin access by source IP
location /system/admin/ {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://cotonti_backend;
}