CVE-2026-55742

Cotonti CSRF in admin.rights.php allows privilege escalation

View on CVE.org
Published Jun 18, 2026 CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Description
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token.

Analysis

AI-generated

Technical impact

Cotonti 1.0.0, based on its master branch commit f43f1fc3, suffers a cross‑site request forgery vulnerability in the administration rights handler. The script at system/admin/admin.rights.php processes rights updates without verifying the anti‑CSRF token, allowing an attacker to craft a forged request that alters group access rights, including via cot_auth_add_group.

Affected Systems

The vulnerability affects the Cotonti content management system, version 1.0.0 based on the master branch commit f43f1fc3. Any deployment running this branch or earlier without the patch is susceptible.

Risk and Exploitability

The flaw carries a CVSS score of 9.4, indicating critical severity. The EPSS score is below 1%, meaning the likelihood of exploitation in the wild is currently low, and it is not listed in CISA’s KEV catalog. Nonetheless, the attack vector is straightforward: a malicious site can force a victim admin’s browser to submit the forged request, making it a practical risk for sites with exposed or internet‑accessible admin interfaces.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Cotonti to a version that includes the CSRF fix (commit f43f1fc3 or later).
  • Restrict administration access to trusted IP ranges or a VPN to limit exposure to CSRF payloads from untrusted origins.
  • Enforce stricter authentication for administrators, such as two‑factor authentication or mandatory logout after administrative sessions.

Generated by OpenCVE AI on August 10, 2026 at 23:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-7g3p-35vc-mgjr Cotonti: Cross-Site Request Forgery in the administration rights handler
History
Type Values Removed Values Added
Description Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated administrator into visiting a malicious page can force the browser to submit a forged request that grants elevated permissions to an attacker-controlled group, escalating privileges to administrator. Because Cotonti administrators can modify templates and configuration, this can be further leveraged toward remote code execution. Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token.
Title Cotonti - CSRF in admin.rights.php Allows Privilege Escalation Cotonti CSRF in admin.rights.php allows privilege escalation
Type Values Removed Values Added
Title Cotonti CSRF in admin.rights.php allows privilege escalation Cotonti - CSRF in admin.rights.php Allows Privilege Escalation
Type Values Removed Values Added
First Time appeared Cotonti
Cotonti cotonti
Vendors & Products Cotonti
Cotonti cotonti
Type Values Removed Values Added
Description Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated administrator into visiting a malicious page can force the browser to submit a forged request that grants elevated permissions to an attacker-controlled group, escalating privileges to administrator. Because Cotonti administrators can modify templates and configuration, this can be further leveraged toward remote code execution.
Title Cotonti CSRF in admin.rights.php allows privilege escalation
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)

Sources

Status
PUBLISHED
Assigner
TuranSec
Published
Updated
Aug 10, 2026, 11:44 AM
Reserved
Jun 17, 2026, 12:59 PM

View source JSON

Updated
Jun 18, 2026, 12:54 PM

JSON

Status
Deferred
Published
Jun 18, 2026, 8:16 AM
Modified
Aug 10, 2026, 12:17 PM

View source JSON

No data.

Updated
Aug 10, 2026, 11:15 PM

JSON