CVE-2018-9856: Kotti CSRF Permission Change Vulnerability
Summary
CVE-2018-9856: Kotti CSRF in the local roles implementation. Affects kotti across 2 version ranges.
< 1.3.2
>= 2.0.0a1, < 2.0.0b2
Fixed in 1.3.2 or 2.0.0b2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kotti is an open-source Python web application framework used for building content management systems. It provides a flexible and customizable platform for creating websites and web applications. The vulnerability identified as CVE-2018-9856 affects Kotti versions before 1.3.2 and 2.x before 2.0.0b2. This vulnerability allows an attacker to exploit Cross-Site Request Forgery (CSRF) in the local roles implementation, enabling them to trigger a permission change via a /admin-document/@@share request.
Vulnerability Detail
The vulnerability arises due to insufficient CSRF protection in the local roles implementation of Kotti. An attacker can craft a malicious request that, when executed by an authenticated user with sufficient privileges, can modify the permissions of a document. By exploiting this vulnerability, an attacker can gain unauthorized access to sensitive information, modify content, or perform other malicious actions within the affected Kotti instance. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 2.0.9 as of 22 Oct 2026
pip install --upgrade "kotti==2.0.9"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.3.21.3.2pip install --upgrade "kotti==1.3.2" -
>= 2.0.0a1, < 2.0.0b22.0.0b2pip install --upgrade "kotti==2.0.0b2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the affected functionality or restrict access to the vulnerable endpoints. However, this may impact the functionality and usability of the Kotti instance. It is strongly advised to apply the recommended fix by upgrading to the latest fixed version.
Conclusion
The CSRF permission change vulnerability in Kotti can lead to unauthorized access and modification of sensitive information. It is crucial to apply the recommended fix by upgrading to the latest fixed version of Kotti. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for kotti →
FAQ
Kotti is an open-source Python web application framework used for building content management systems. It provides a flexible and customizable platform for creating websites and web applications.
CSRF (Cross-Site Request Forgery) is a type of attack where an attacker tricks a victim into performing unwanted actions on a web application in which the victim is authenticated.
By exploiting this vulnerability, an attacker can gain unauthorized access to sensitive information, modify content, or perform other malicious actions within the affected Kotti instance.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Kotti. For versions before 1.3.2, upgrade to version 1.3.2 or later. For versions 2.x before 2.0.0b2, upgrade to version 2.0.0b2 or later.
