CVE-2026-101093

Name of the Vulnerable Software and Affected Versions Cotonti version 1.0.0

Description A cross-site request forgery (CSRF) issue exists in the 'admin.users.php' endpoint. This occurs because the system fails to perform token verification, allowing an attacker to trick an authenticated administrator into deleting custom user groups and their associated permissions by leveraging the administrator's active session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.