CVE-2026-55742

Name of the Vulnerable Software and Affected Versions Cotonti version 1.0.0

Description Cross-Site Request Forgery (CSRF) exists in the administration rights handler. In the endpoint 'system/admin/admin.rights.php', the rights update action a=update modifies group access rights, including through the cot auth add group() function, without calling cot check xg() to validate the anti-CSRF token. A remote attacker can lure an authenticated administrator to a malicious page to submit a forged request, granting elevated permissions to an attacker-controlled group and escalating privileges to administrator. Since administrators can modify templates and configuration, this may lead to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.