CVE-2026-55742: Cotonti CSRF in admin.rights.php allows privilege escalation

Published Jun 18, 2026

Updated

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cotauthaddgroup) without calling cotcheckxg to validate the anti-CSRF token.

Affected Software

1 affected component

Cotonti Cotonti=1.0.0

Event History

Jun 18, 2026

CVE Published

via MITRE·06:05 AM

Data Sourced

via MITRE·06:05 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-55742?

CVE-2026-55742 has a critical severity score of 9.6.

What can CVE-2026-55742 be exploited for?

CVE-2026-55742 can be exploited to perform Cross-Site Request Forgery, allowing for privilege escalation in the administration rights handler.

How do I fix CVE-2026-55742?

To fix CVE-2026-55742, update to the latest version of Cotonti that addresses this CSRF vulnerability.

What software is affected by CVE-2026-55742?

CVE-2026-55742 affects Cotonti version 1.0.0 in the master branch.

What impact does CVE-2026-55742 have on systems?

CVE-2026-55742 can lead to unauthorized changes in user group access rights, compromising system security.