{"id":"CVE-2018-9856","aliases":["EUVD-2018-0086","GHSA-3hq4-f2v6-q338","PYSEC-2018-10"],"status":"published","title":"Kotti CSRF in the local roles implementation","description":"Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00633,"percentile":0.50624,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2018-04-09T07:00:00Z","modified":"2026-10-20T10:50:33Z","fixes":[{"ecosystem":"PyPI","package":"kotti","fixed_in":["1.3.2","2.0.0b2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"kotti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"kotti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0a1"},{"last_affected":"2.0.0b1"},{"fixed":"2.0.0b2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"kotti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}],"versions":["0.1","0.1.1","0.10a1","0.10a2","0.10a3","0.10a4","0.10b1","0.1a1","0.1a2","0.1a3","0.1a4","0.1a5","0.1a6","0.1a7","0.1a8","0.1a9","0.2","0.2.1","0.2.10","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.2.8","0.2.9","0.2a1","0.2a2","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.5.0","0.5.0a1","0.5.0a2","0.5.0a3","0.5.0a4","0.5.0a5","0.5.0a6","0.5.0a7","0.5.0rc1","0.5.0rc2","0.5.1","0.5.2","0.6.0","0.6.0b1","0.6.0b2","0.6.0b3","0.6.1","0.6.2","0.6.3","0.7","0.7.1","0.7.2","0.7a1","0.7a2","0.7a3","0.7a4","0.7a5","0.7a6","0.7rc1","0.8","0.8a1","0.8a2","0.8b1","0.8b2","0.9","0.9.1","0.9.2","0.9a1","0.9a2","0.9b1","0.9b2","1.0.0","1.0.0-alpha","1.0.0-alpha.2","1.0.0-alpha.3","1.0.0-alpha.4","1.1.0","1.1.0-alpha.1","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.3.0","1.3.0a1","1.3.0a2","1.3.0a3","1.3.0a4","1.3.1"]},{"source":"osv","ecosystem":"PyPI","package":"kotti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0a1"},{"fixed":"2.0.0b2"}]}],"versions":["2.0.0a1","2.0.0b1"]},{"source":"osv","ecosystem":"PyPI","package":"kotti","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}],"versions":["0.1","0.1.1","0.10a1","0.10a2","0.10a3","0.10a4","0.10b1","0.1a1","0.1a2","0.1a3","0.1a4","0.1a5","0.1a6","0.1a7","0.1a8","0.1a9","0.2","0.2.1","0.2.10","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.2.8","0.2.9","0.2a1","0.2a2","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.5.0","0.5.0a1","0.5.0a2","0.5.0a3","0.5.0a4","0.5.0a5","0.5.0a6","0.5.0a7","0.5.0rc1","0.5.0rc2","0.5.1","0.5.2","0.6.0","0.6.0b1","0.6.0b2","0.6.0b3","0.6.1","0.6.2","0.6.3","0.7","0.7.1","0.7.2","0.7a1","0.7a2","0.7a3","0.7a4","0.7a5","0.7a6","0.7rc1","0.8","0.8a1","0.8a2","0.8b1","0.8b2","0.9","0.9.1","0.9.2","0.9a1","0.9a2","0.9b1","0.9b2","1.0.0","1.0.0-alpha","1.0.0-alpha.2","1.0.0-alpha.3","1.0.0-alpha.4","1.1.0","1.1.0-alpha.1","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.3.0","1.3.0a1","1.3.0a2","1.3.0a3","1.3.0a4","1.3.1"]}],"products":[{"vendor":"kotti_project","product":"kotti"}],"references":[{"url":"https://github.com/Kotti/Kotti/issues/551","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9856","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3hq4-f2v6-q338","tags":["advisory"]},{"url":"https://github.com/Kotti/Kotti/commit/69d3c8a5d7203ddaec5ced5901acf87baddd76be","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/kotti/PYSEC-2018-10.yaml","tags":["web"]},{"url":"https://github.com/Kotti/Kotti","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-9856","description":"Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.","status":"published","published":"2018-04-09T07:00:00Z","modified":"2024-09-16T20:22:43.906Z","updated_at":"2026-11-02T14:35:02.603326Z"}],"euvd":[{"id":"EUVD-2018-0086","description":"Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.","status":"published","published":"2018-04-09T07:00:00Z","modified":"2024-09-16T20:22:43Z","updated_at":"2026-11-03T00:55:14.527578Z"}],"ghsa":[{"id":"GHSA-3hq4-f2v6-q338","title":"Kotti CSRF in the local roles implementation","description":"Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a `/admin-document/@@share` request.","status":"published","published":"2018-07-12T20:30:30Z","modified":"2024-09-27T21:18:50Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:38:06.988799Z"}],"nvd":[{"id":"CVE-2018-9856","description":"Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.","status":"published","published":"2018-04-09T07:29:00.233Z","modified":"2026-06-17T02:07:17.99Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:04:24.700429Z"}],"osv":[{"id":"CVE-2018-9856","description":"Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.","status":"published","published":"2018-04-09T07:29:00.233Z","modified":"2026-10-20T10:50:33.257905064Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"GHSA-3hq4-f2v6-q338","title":"Kotti CSRF in the local roles implementation","description":"Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a `/admin-document/@@share` request.","status":"published","published":"2018-07-12T20:30:30Z","modified":"2024-09-27T21:22:59.24936Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"PYSEC-2018-10","description":"Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.","status":"published","published":"2018-04-09T07:29:00Z","modified":"2023-11-08T04:00:30.372698Z","updated_at":"2026-11-02T15:52:51.645172Z"}]}}