CVE-2026-101093
Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 28, 2026
- Updated
- Sep 29, 2026
- Reserved
- Sep 27, 2026
Description
Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated permissions by riding the administrator's session.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L | VulnCheck |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
CotontiCotonti |
|
References
- https://github.com/Cotonti/Cotonti/issues/1907#issuecomment-5845691148issue-tracking
- https://github.com/Cotonti/Cotonti/pull/1908issue-trackingpatch
- https://github.com/Cotonti/Cotonti/blob/1.0.0/system/admin/admin.users.php#L136-L140technical-description
- https://github.com/Cotonti/Cotontiproduct
- VulnCheck Advisory: Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.