CVE-2026-93870: Cotonti CMS CSRF Vulnerability

CVE-2026-93870 Overview

Cotonti through version 1.0.0 contains a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the ratings plugin AJAX handler. The ratings.ajax.php endpoint fails to validate anti-CSRF tokens before processing rating submissions. Attackers can craft malicious web pages that automatically submit POST requests to the vulnerable endpoint. When an authenticated Cotonti user visits such a page, their browser silently forges rating submissions on their behalf, modifying stored rating data without consent.

Critical Impact
Authenticated users who visit an attacker-controlled page can be forced to submit forged ratings, corrupting stored rating integrity in the Cotonti application.

Affected Products

Cotonti CMS through version 1.0.0
Cotonti ratings plugin (plugins/ratings/ratings.ajax.php)
Deployments exposing the ratings AJAX handler to authenticated sessions

Discovery Timeline

2026-09-18 - CVE-2026-93870 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93870

Vulnerability Analysis

The vulnerability resides in the ratings plugin AJAX handler shipped with Cotonti. State-changing POST requests to ratings.ajax.php are processed without verifying an anti-CSRF token bound to the user's session. Any authenticated browser session becomes a usable execution context for a remote attacker.

Exploitation requires only that a logged-in Cotonti user load attacker-controlled HTML. A hidden form or fetch() call auto-submits the forged rating request, and the browser attaches session cookies automatically. The server accepts the request as legitimate because it never validates request origin or a per-session nonce. The result is unauthorized modification of rating data attributed to the victim account.

The impact is scoped to rating data integrity. There is no direct path to code execution, authentication bypass, or confidential data disclosure through this flaw. However, forged ratings can distort reputation systems, moderation signals, and any downstream logic that trusts rating counts.

Root Cause

The root cause is missing CSRF token validation on a state-changing endpoint. The handler relies solely on session cookies for authorization, which browsers submit automatically on cross-origin requests. Refer to the Cotonti ratings plugin source for the vulnerable handler.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a page containing a form or script that targets the Cotonti ratings AJAX endpoint. When a currently authenticated victim visits the page, the request executes under the victim's session. See the VulnCheck advisory for the disclosure details and the upstream issue #1892 for reproduction context.

No exploitation code is reproduced here; consult the referenced advisories for technical detail.

Detection Methods for CVE-2026-93870

Indicators of Compromise

POST requests to plugins/ratings/ratings.ajax.php with Referer or Origin headers pointing to third-party domains.
Sudden bursts of rating submissions from a single authenticated user across many items in a short window.
Rating submissions correlated with user complaints about ratings they did not cast.

Detection Strategies

Inspect web server and application logs for requests to the ratings AJAX handler that lack a same-origin Referer or Origin header.
Correlate authenticated session IDs with request origin headers to flag cross-origin state changes.
Baseline normal rating submission velocity per user and alert on statistical outliers.

Monitoring Recommendations

Forward web access logs and application audit logs for the Cotonti ratings endpoint to a centralized analytics pipeline.
Enable Web Application Firewall (WAF) rules that log cross-origin POST requests to /plugins/ratings/* for review.
Track anomalous rating mutations in the database and alert on unexpected write patterns.

How to Mitigate CVE-2026-93870

Immediate Actions Required

Restrict access to the ratings plugin endpoint or disable the plugin until a patched version is deployed.
Enforce SameSite=Lax or SameSite=Strict on Cotonti session cookies to break cross-origin cookie attachment.
Deploy WAF rules that reject POST requests to plugins/ratings/ratings.ajax.php when Origin does not match the site host.

Patch Information

Refer to the upstream fix in Cotonti Pull Request #1900, which addresses the missing CSRF token validation in the ratings plugin AJAX handler. Track the Cotonti repository for release tags incorporating the fix beyond 1.0.0 and upgrade affected deployments accordingly.

Workarounds

Disable the ratings plugin in the Cotonti administration console if it is not business-critical.
Add server-side request filtering that rejects requests to the ratings endpoint when Origin/Referer headers are absent or off-site.
Configure session cookies with SameSite=Strict to prevent browsers from attaching them to cross-site POSTs.

bash

# Example nginx rule to block cross-origin POSTs to the ratings endpoint
location ~ ^/plugins/ratings/ratings\.ajax\.php$ {
    if ($request_method = POST) {
        if ($http_origin !~* ^https?://(www\.)?example\.com$) {
            return 403;
        }
    }
}