Cotonti through version 1.0.0 is affected by a CSRF vulnerability in its extensions manager component. Due to the lack of anti-CSRF token validation, attackers can craft malicious links or embedded content that, when visited by an authenticated administrator, trigger state-changing actions on extensions without their consent. This can lead to unauthorized modification of the system's extensions state.

An attacker can cause an authenticated administrator to unknowingly perform actions such as installing, updating, pausing, or unpausing extensions. This could lead to integrity and availability impacts on the affected system. Confidentiality is not impacted. The CVSS v3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid visiting untrusted links or pages while authenticated in the Cotonti extensions manager. Implementing manual CSRF protections or restricting access to the extensions manager may reduce risk.