CVE-2018-9856
Kotti CSRF in the local roles implementation
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.
- Record
CVE-2018-9856- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.
- Record
CVE-2018-9856- Updated
- 2026-11-02
EUVDEUVD-2018-0086 No score
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.
- Record
EUVD-2018-0086- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3hq4-f2v6-q338
Kotti CSRF in the local roles implementation
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.
- Record
GHSA-3hq4-f2v6-q338- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.
- Record
CVE-2018-9856- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-3hq4-f2v6-q338
Kotti CSRF in the local roles implementation
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.
- Record
GHSA-3hq4-f2v6-q338- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVPYSEC-2018-10 No score
Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.
- Record
PYSEC-2018-10- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kottiPyPI |
before 1.3.2 | 1.3.2 |
kottiPyPI |
2.0.0a1 to 2.0.0b1 | 2.0.0b2 |
kottiPyPI |
before 1.3.2, plus listed versions 0.10.1.10.10a10.10a20.10a3 Show 45 moreShow less0.10a40.10b10.1a10.1a20.1a30.1a40.1a50.1a60.1a70.1a80.1a90.20.2.10.2.100.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.2a10.2a20.3.00.3.10.4.00.4.10.4.20.4.30.4.40.4.50.5.00.5.0a10.5.0a20.5.0a30.5.0a40.5.0a50.5.0a60.5.0a70.5.0rc10.5.0rc20.5.10.5.20.6.0 |
1.3.2 |
kottiPyPI |
2.0.0a1 up to 2.0.0b2, plus listed versions 2.0.0b1 |
2.0.0b2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-9856 is a high vulnerability (CVSS 8.8) in Kotti Project Kotti, published April 9, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in kotti 1.3.2.
References
Left out here: 51 versions. The JSON record has them.