CVE-2026-55741

Name of the Vulnerable Software and Affected Versions Cotonti version 1.0.0

Description Cross-Site Request Forgery (CSRF) exists in the administration configuration handler. In the 'system/admin/admin.config.php' file, the configuration update action 'a=update' processes POST data through the cot config update options() function without calling cot check xg() to validate the anti-CSRF token provided in the x parameter. This allows a remote attacker to lure an authenticated administrator to a malicious page, forcing the browser to submit a forged request that modifies arbitrary core, module, or plugin configuration options, potentially weakening security or enabling further compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.