A cross‑site request forgery flaw exists in the Cotonti administration rights handler, allowing a remote attacker to trick a logged‑in administrator into submitting a forged request that grants the attacker control over a group with administrative privileges. The lack of CSRF token validation in the update action lets an attacker elevate privileges to administrator level. With administrator access to templates and configuration, this flaw can be used as an initial foothold for remote code execution.

The vulnerability affects the Cotonti content management system, version 1.0.0 based on the master branch commit f43f1fc3. Any deployment running this branch or earlier without the patch is susceptible.

The flaw carries a CVSS score of 9.4, indicating critical severity. The EPSS score is below 1%, meaning the likelihood of exploitation in the wild is currently low, and it is not listed in CISA’s KEV catalog. Nonetheless, the attack vector is straightforward: a malicious site can force a victim admin’s browser to submit the forged request, making it a practical risk for sites with exposed or internet‑accessible admin interfaces.