CVE-2026-101093
MEDIUMCVSS 5.4Description
Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated permissions by riding the administrator's session.
Timeline
Published:September 28th, 2026 10:17 PM
Last modified:September 29th, 2026 2:17 PM
CVSS Scoring
CVSS v3: 5.4 (MEDIUM)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://github.com/Cotonti/Cotonti
- https://github.com/Cotonti/Cotonti/blob/1.0.0/system/admin/admin.users.php#L136-L140
- https://github.com/Cotonti/Cotonti/issues/1907#issuecomment-5845691148
- https://github.com/Cotonti/Cotonti/pull/1908
- https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-via-user-group-deletion
Source: NIST NVD · Data may lag official sources by up to one minute