Cross-Site Request Forgery Vulnerability in Cotonti Admin Rights Handler

CVE-2026-55742

What is CVE-2026-55742?

The Cotonti platform version 1.0.0 contains a vulnerability in the administration rights handler that allows for a Cross-Site Request Forgery (CSRF) attack. Specifically, in the system/admin/admin.rights.php file, the rights update action lacks the necessary checks to validate anti-CSRF tokens, enabling attackers to forge requests. By enticing an authenticated administrator to a malicious page, an attacker can exploit this vulnerability to manipulate group access rights, potentially granting elevated permissions to malicious actors. Given that Cotonti administrators have the authority to alter templates and configurations, this security flaw may also lead to remote code execution, significantly compromising the integrity and security of the system.

References