CVE-2026-55742 | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable… | CVSS 9.6 CRITICAL

Description

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated administrator into visiting a malicious page can force the browser to submit a forged request that grants elevated permissions to an attacker-controlled group, escalating privileges to administrator. Because Cotonti administrators can modify templates and configuration, this can be further leveraged toward remote code execution.

Metadata

CVE ID: CVE-2026-55742
State: PUBLISHED
Assigner: TuranSec
Reserved: 2026-06-17 12:59 UTC
Published: 2026-06-18 06:05 UTC
Last updated: 2026-06-18 12:54 UTC
Primary CWE: CWE-352
CWE-352 Cross-Site Request Forgery (CSRF)
Vendor / Product: Cotonti / Cotonti
Sources: cve.org · NVD

Severity & Metrics

9.6 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Cotonti	Cotonti	—	1.0.0

Weakness (CWE)

CWE	Source	Description
CWE-352	cna	CWE-352 Cross-Site Request Forgery (CSRF)

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.6	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
9.4	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References (2)

Vulnerable code: system/admin/admin.rights.php https://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/system/admin/admin.rights.php#L53
https://github.com/Cotonti/Cotonti