CVE-2026-55742
CVE-2026-55742 · Cotonti CSRF in admin.rights.php allows privilege escalation
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token.
CVSS 9.4 · Critical · EPSS 0.2%
- Published
- Updated
Stack: php
Affected products and versions
cotonti
- Versions
- 1.0.0: Affected (semver)
No fix published
cotonti/cotonti Packagist
- Versions
- 0.9.23
- 0.9.24
- 0.9.24.1
- 0.9.24.2
- 0.9.25
- 1.0.0
- Affected ranges
- ECOSYSTEM: ≤ 1.0.0
No fix published