Which versions of Cotonti are affected by CVE-2026-55741?

Cotonti 1.0.0 contains a cross-site request forgery (CSRF) vulnerability in its administration panel that allows attackers to trick authenticated administrators into silently modifying core system…

How to fix or mitigate CVE-2026-55741?

24 hours: Audit recent admin panel access logs and configuration change history; identify all systems running Cotonti 1.0.0; implement temporary IP whitelisting to restrict admin panel access to known administrator locations. 7 days: Deploy Web Application Firewall (WAF) rules to detect and block CSRF patterns; configure SameSite=Strict cookie attributes for session management; enforce password resets for all administrator accounts. 30 days: No vendor-released patch identified at time of analysis; evaluate alternative content management systems with stronger CSRF protections; establish ongoing security monitoring for Cotonti advisories. Threat context: No public exploit identified at time of analysis, but vulnerability is readily exploitable through social engineering.

Cotonti CVE-2026-55741

Q: What is the CVSS score of CVE-2026-55741?

CVE-2026-55741 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-37853 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-18 TuranSec

GHSA-7w6j-5mfv-gf3p

PHP CSRF Cotonti

8.7

CVSS 4.0 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-delivered CSRF requires no attacker privileges (PR:N) but needs admin victim interaction (UI:R); successful config tampering yields full C/I/A impact within the application scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jun 18, 2026 - 08:47 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 18, 2026 - 08:37 vuln.today

cvss_changed

CVSS changed

Jun 18, 2026 - 08:37 NVD

8.8 (HIGH) 8.7 (HIGH)

Analysis Generated

Jun 18, 2026 - 08:00 vuln.today

DescriptionCVE.org

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action ('a=update') processes POST data via cot_config_update_options() without calling cot_check_xg() to validate the anti-CSRF token (the 'x' parameter), unlike other admin handlers (e.g. admin.structure.php, admin.cache.php). A remote attacker who lures an authenticated administrator into visiting a malicious page can force the browser to submit a forged request that modifies arbitrary core, module, or plugin configuration options, which can be leveraged to weaken security or enable further compromise.

AnalysisAI

Cross-site request forgery in Cotonti 1.0.0 (commit f43f1fc3) administration configuration handler allows a remote attacker to coerce an authenticated administrator's browser into silently modifying arbitrary core, module, or plugin configuration options. The flaw in system/admin/admin.config.php stems from the 'a=update' action invoking cot_config_update_options() without the cot_check_xg() anti-CSRF token check used elsewhere in the admin panel. No public exploit identified at time of analysis, though the root cause is well-documented at the source line level by the reporter (TuranSec).

Technical ContextAI

Cotonti is a PHP-based open-source content management framework. The vulnerability is a classic CWE-352 (Cross-Site Request Forgery) defect: the admin configuration update endpoint accepts POST submissions and persists them via cot_config_update_options() but skips the framework's own cot_check_xg() helper that validates the 'x' anti-CSRF token parameter. Other admin handlers in the same codebase (admin.structure.php, admin.cache.php) do call cot_check_xg(), making this an inconsistent omission rather than a missing primitive. The CPE cpe:2.3:a:cotonti:cotonti:*:*:*:*:*:*:*:* shows all versions are flagged pending vendor confirmation, but the reporter specifically pins the issue to commit f43f1fc3 on the master branch labeled 1.0.0.

RemediationAI

No vendor-released patch identified at time of analysis. The structural fix is to add a cot_check_xg() call (matching the pattern already used in admin.structure.php and admin.cache.php) at the top of the 'a=update' branch in system/admin/admin.config.php near line 55, rejecting requests whose 'x' token does not match the session value. Until an upstream release ships, administrators should apply this one-line guard locally, restrict admin panel access by IP allowlist or VPN to reduce the attack surface for CSRF lures, and adopt strict session hygiene (log out of the admin panel before browsing other sites, use a dedicated browser profile for administration). Setting the session cookie's SameSite attribute to Lax or Strict via PHP or web-server configuration blocks most cross-site POST flows but may break legitimate cross-origin admin workflows if any exist. Track upstream at https://github.com/Cotonti/Cotonti for a tagged fix.