Cotonti 1.0.0 suffers from a Cross‑Site Request Forgery flaw in the administration configuration handler. The update action (`a=update`) accepts POST data through `cot_config_update_options()` without first validating the anti‑CSRF token parameter (`x`), unlike other admin handlers. This omission allows an attacker to force an authenticated administrator to submit a forged request that changes any core, module, or plugin configuration option. The resulting configuration changes can weaken security controls or facilitate further compromise. The weakness is catalogued as CWE‑352.

The vulnerability affects the Cotonti content management system, specifically the master branch commit f43f1fc3 (version 1.0.0).

The CVSS v3.1 score is 8.7, indicating a high severity that grants the attacker the ability to alter system configuration with the permission of an authenticated admin. The EPSS score is less than 1%, suggesting that exploit attempts are currently rare, possibly due to the need to lure an administrator into visiting a malicious page. The vulnerability is not listed in CISA's KEV catalogue. The likely attack vector requires an attacker to convince a logged‑in administrator to load a malicious site, which then submits the forged POST request. If successful, the attacker can modify security‑relevant settings and pave the way for further intrusion. The absence of an exposed administrative API mitigates widespread automation of the exploit, but web‑based social engineering remains effective.