CVE-2026-101093: Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion
Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated permissions by riding the administrator's session.
Affected Software
Event History
Frequently Asked Questions
Who can be targeted by this issue?
An authenticated Cotonti administrator can be targeted because the attack relies on the administrator's active session. The attacker does not need an account or administrative privileges of their own, but must persuade the administrator to visit a malicious link or page.
What is affected when exploitation succeeds?
The attacker can cause deletion of custom user groups and their associated permissions. The described impact is integrity and availability loss; no confidentiality impact is stated.
How can administrators determine whether their deployment is affected?
Cotonti versions through 1.0.0 are identified as affected. The vulnerable group-deletion handling is in admin.users.php and lacks token verification.