Cotonti CVE-2026-55741

Requires (1) a target running Cotonti at or near commit f43f1fc3 with the admin configuration module present, (2) an administrator who is currently logged in with an active session cookie in the same browser, (3) that administrator visiting attacker-controlled content (UI:P in CVSS), and (4) the browser not enforcing SameSite=Lax/Strict on the Cotonti session cookie for the request method used. Exploitation is limited by the need for social engineering against a specific privileged user and by modern browsers' default SameSite=Lax behavior, which blocks cross-site POST submissions unless the site explicitly opts out - sites that have not set SameSite=None are de facto protected against the form-POST variant by current Chromium/Firefox defaults.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) scores 8.7 by treating the victim administrator's session as the privilege source - the attacker themselves needs no credentials, only the victim's interaction (UI:P) with a malicious page while logged in. Real-world risk is meaningfully lower than the headline score implies because exploitation requires an active admin session in the targeted browser and successful social engineering to visit attacker-controlled content; this is not a wormable or scanner-discoverable flaw. EPSS and KEV data were not provided and no public exploit is identified, suggesting opportunistic rather than mass exploitation. Worth noting: PR:N in the CVSS vector reflects attacker prerequisites, not the targeted endpoint's protection model - the endpoint itself is admin-only, which limits the blast radius to deployments with active admins browsing untrusted content.

An attacker crafts a webpage containing a hidden auto-submitting HTML form (or fetch() call) targeting /admin.php?m=config&a=update with POST fields that change a security-relevant Cotonti option - for example, disabling registration approval, enabling debug output that leaks paths, or pointing a plugin's callback URL to attacker infrastructure. The attacker lures a logged-in Cotonti administrator to that page (phishing email, comment spam, watering-hole), and the victim's browser silently submits the request with their admin session cookie, applying the configuration change. No public proof-of-concept is referenced in the supplied data, but the root cause is mechanically simple and well-described.