CVE-2026-101093 - Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion

Back Back to CVE browser

MEDIUM

Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion

Published Sep 28, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.12%

Description

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated permissions by riding the administrator's session.

Affected products

Vendor Cotonti Product Cotonti Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.0.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cotonti

unaffected

Version	Status	Constraints
0	affected	<=1.0.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88561
Advisory
https://github.com/Cotonti/Cotonti
product
https://github.com/Cotonti/Cotonti/blob/1.0.0/system/admin/admin.users.php#L136-L140
technical-description
https://github.com/Cotonti/Cotonti/issues/1907#issuecomment-5845691148
issue-tracking
https://github.com/Cotonti/Cotonti/pull/1908
issue-trackingpatch
https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-via-user-group-deletion
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88561		Advisory
https://github.com/Cotonti/Cotonti		product
https://github.com/Cotonti/Cotonti/blob/1.0.0/system/admin/admin.users.php#L136-L140		technical-description
https://github.com/Cotonti/Cotonti/issues/1907#issuecomment-5845691148		issue-tracking
https://github.com/Cotonti/Cotonti/pull/1908		issue-trackingpatch
https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-via-user-group-deletion		third-party-advisory