Description
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token.
Published: 2026-06-18
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Cotonti 1.0.0, based on its master branch commit f43f1fc3, suffers a cross‑site request forgery vulnerability in the administration rights handler. The script at system/admin/admin.rights.php processes rights updates without verifying the anti‑CSRF token, allowing an attacker to craft a forged request that alters group access rights, including via cot_auth_add_group.

Affected Systems

The vulnerability affects the Cotonti content management system, version 1.0.0 based on the master branch commit f43f1fc3. Any deployment running this branch or earlier without the patch is susceptible.

Risk and Exploitability

The flaw carries a CVSS score of 9.4, indicating critical severity. The EPSS score is below 1%, meaning the likelihood of exploitation in the wild is currently low, and it is not listed in CISA’s KEV catalog. Nonetheless, the attack vector is straightforward: a malicious site can force a victim admin’s browser to submit the forged request, making it a practical risk for sites with exposed or internet‑accessible admin interfaces.

Generated by OpenCVE AI on August 10, 2026 at 23:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Cotonti to a version that includes the CSRF fix (commit f43f1fc3 or later).
  • Restrict administration access to trusted IP ranges or a VPN to limit exposure to CSRF payloads from untrusted origins.
  • Enforce stricter authentication for administrators, such as two‑factor authentication or mandatory logout after administrative sessions.

Generated by OpenCVE AI on August 10, 2026 at 23:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-7g3p-35vc-mgjr Cotonti: Cross-Site Request Forgery in the administration rights handler
History

Mon, 10 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated administrator into visiting a malicious page can force the browser to submit a forged request that grants elevated permissions to an attacker-controlled group, escalating privileges to administrator. Because Cotonti administrators can modify templates and configuration, this can be further leveraged toward remote code execution. Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token.
Title Cotonti - CSRF in admin.rights.php Allows Privilege Escalation Cotonti CSRF in admin.rights.php allows privilege escalation

Mon, 10 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Title Cotonti CSRF in admin.rights.php allows privilege escalation Cotonti - CSRF in admin.rights.php Allows Privilege Escalation

Wed, 24 Jun 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Cotonti
Cotonti cotonti
Vendors & Products Cotonti
Cotonti cotonti

Thu, 18 Jun 2026 16:45:00 +0000

Type Values Removed Values Added
Description Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated administrator into visiting a malicious page can force the browser to submit a forged request that grants elevated permissions to an attacker-controlled group, escalating privileges to administrator. Because Cotonti administrators can modify templates and configuration, this can be further leveraged toward remote code execution.
Title Cotonti CSRF in admin.rights.php allows privilege escalation
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Subscriptions

Cotonti Cotonti
cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-08-10T11:44:23.141Z

Reserved: 2026-06-17T12:59:17.621Z

Link: CVE-2026-55742

cve-icon Vulnrichment

Updated: 2026-06-18T12:54:32.368Z

cve-icon NVD

Status : Deferred

Published: 2026-06-18T08:16:34.100

Modified: 2026-08-10T12:17:18.843

Link: CVE-2026-55742

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T23:15:05Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)