CVE-2026-101093
5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Summary
Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated permissions by riding the administrator's session.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Cotonti | Cotonti | 0 <= 1.0.0 | affected |
Weaknesses
- CWE-352: Cross-Site Request Forgery (CSRF)
References
- https://github.com/Cotonti/Cotonti/issues/1907#issuecomment-5845691148
- https://github.com/Cotonti/Cotonti/pull/1908
- https://github.com/Cotonti/Cotonti/blob/1.0.0/system/admin/admin.users.php#L136-L140
- https://github.com/Cotonti/Cotonti
- https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-via-user-group-deletion
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.