rootpwn

medium · CVSS v3 5.4 · CVSS v4 5.3 · EPSS 0.00124

CVE-2026-100524

CVE-2026-100524 is a cross‑site request forgery flaw in Cotonti 1.0.0’s extensions manager. It allows an attacker to trigger state‑changing

Overview

CVE-2026-100524 is a cross‑site request forgery flaw in Cotonti 1.0.0’s extensions manager. It allows an attacker to trigger state‑changing actions such as installing, updating, pausing, or unpausing extensions without the user’s consent. The vulnerability is exploitable only when an administrator is authenticated and visits a crafted URL.

Description

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause extensions by tricking them into visiting a malicious page while authenticated.

Impact

The flaw compromises the integrity of the CMS by enabling unauthorized modification of installed extensions. Administrators and site owners are directly impacted, as their privileged actions can be hijacked. Confidentiality is not directly affected, and availability is unlikely to be disrupted.

Remediation

Apply the latest Cotonti patch or upgrade to a version that includes CSRF protection for the extensions manager. If an upgrade is not possible, disable the extensions manager or restrict its access to a trusted IP range. Additionally, enforce same‑site cookies and enable a global CSRF token for all admin actions.

Risk context

The CVE has a medium severity score (CVSS 5.4) and an EPSS of 0.00124, indicating a low probability of exploitation but still requiring timely attention for administrators.

Affected products

  • Cotonti 1.0.0

Scores

Severity
medium
CVSS v2
6.4
CVSS v3
5.4
CVSS v4
5.3
EPSS
0.00124

CSRF webapp admin extensions state-changing medium low-ep

← All CVEs

Related CVEs

medium

CVE-2026-11871

The Team Members WordPress plugin through 9.2 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.

View analysis

medium

CVE-2026-100604

ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of its original publisher, and transfer and lifecycle authorization checks trust that historical user before requiring current organization privileges. An authenticated user who originally published an organization skill can therefore transfer, delete, or restore that skill — taking control of its trusted name and history — even after their organization privileges have been revoked or downgraded. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. It is fixed by PR #3680, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.

View analysis

medium

CVE-2026-100503

Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines.

View analysis

medium

CVE-2026-100505

Ghidra versions 11.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries with constant byte stores ending in multi-byte lead units to trigger out-of-bounds reads that crash the decompiler or leak adjacent heap memory into decompiled output.

View analysis