---
id: CVE-2026-55742
title: 'Cotonti: Cross-Site Request Forgery in the administration rights handler'
summary: 'Cotonti: Cross-Site Request Forgery in the administration rights handler'
severity: critical
cvss: 9.6
cwe:
  - CWE-352
vendor: cotonti
product: cotonti/cotonti
ecosystem: composer
affected:
  - cotonti/cotonti <= 1.0.0
published: '2026-06-18'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-7g3p-35vc-mgjr'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55742'
  - url: 'https://github.com/Cotonti/Cotonti'
  - url: >-
      https://github.com/Cotonti/Cotonti/blob/f43f1fc38ba4e02027786dad9dac1435c7c52b30/system/admin/admin.rights.php#L53
  - url: 'https://github.com/advisories/GHSA-7g3p-35vc-mgjr'
tags:
  - ghsa
  - composer
epss: 0.00208
epssPercentile: 0.09663
ingestedAt: '2026-06-29T14:31:47.123Z'
---

## Overview

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated administrator into visiting a malicious page can force the browser to submit a forged request that grants elevated permissions to an attacker-controlled group, escalating privileges to administrator. Because Cotonti administrators can modify templates and configuration, this can be further leveraged toward remote code execution.

## Affected packages

- `cotonti/cotonti <= 1.0.0`

## Remediation

Refer to the advisory for the patched release.