CVE-2026-55742

Cotonti CSRF in admin.rights.php allows privilege escalation

View on CVE.org
Published Jun 18, 2026 CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Description
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-7g3p-35vc-mgjr Cotonti: Cross-Site Request Forgery in the administration rights handler
History
Type Values Removed Values Added
Description Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated administrator into visiting a malicious page can force the browser to submit a forged request that grants elevated permissions to an attacker-controlled group, escalating privileges to administrator. Because Cotonti administrators can modify templates and configuration, this can be further leveraged toward remote code execution. Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token.
Title Cotonti - CSRF in admin.rights.php Allows Privilege Escalation Cotonti CSRF in admin.rights.php allows privilege escalation
Type Values Removed Values Added
Title Cotonti CSRF in admin.rights.php allows privilege escalation Cotonti - CSRF in admin.rights.php Allows Privilege Escalation
Type Values Removed Values Added
First Time appeared Cotonti
Cotonti cotonti
Vendors & Products Cotonti
Cotonti cotonti
Type Values Removed Values Added
Description Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated administrator into visiting a malicious page can force the browser to submit a forged request that grants elevated permissions to an attacker-controlled group, escalating privileges to administrator. Because Cotonti administrators can modify templates and configuration, this can be further leveraged toward remote code execution.
Title Cotonti CSRF in admin.rights.php allows privilege escalation
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
TuranSec
Published
Updated
Aug 10, 2026, 11:44 AM
Reserved
Jun 17, 2026, 12:59 PM

View source JSON

Updated
Jun 18, 2026, 12:54 PM

JSON

Status
Deferred
Published
Jun 18, 2026, 8:16 AM
Modified
Aug 10, 2026, 12:17 PM

View source JSON

No data.

Updated
Aug 10, 2026, 11:15 PM

JSON