PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55742 Cotonti CVE debrief

CVE-2026-55742 is a critical Cross-Site Request Forgery (CSRF) vulnerability in Cotonti 1.0.0. The vulnerability exists in the administration rights handler, specifically in the system/admin/admin.rights.php file. An attacker can exploit this vulnerability by luring an authenticated administrator into visiting a malicious page, which can force the browser to submit a forged request that grants elevated permissions to an attacker-controlled group. This can lead to privilege escalation to administrator and potentially be leveraged toward remote code execution. The CVSS score for this vulnerability is 9.4, indicating a critical severity. Administrators of Cotonti 1.0.0 should take immediate action to mitigate this vulnerability.

Vendor
Cotonti
Product
Unknown
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-18
Original CVE updated
2026-06-22
Advisory published
2026-06-18
Advisory updated
2026-06-22

Who should care

Cotonti 1.0.0 administrators and users with administrative rights should be aware of this vulnerability and take necessary actions to prevent exploitation. Additionally, security teams and IT professionals responsible for managing and securing Cotonti installations should prioritize patching and mitigation efforts.

Technical summary

The vulnerability is caused by the lack of validation of the anti-CSRF token in the rights update action ('a=update') of the system/admin/admin.rights.php file. Specifically, the cot_check_xg() function is not called to validate the token, allowing an attacker to forge a request that modifies group access rights. This can be exploited by an attacker who lures an authenticated administrator into visiting a malicious page, which can force the browser to submit a forged request.

Defensive priority

high

Recommended defensive actions

  • Apply the latest patch or update to Cotonti 1.0.0 to fix the vulnerability.
  • Implement additional security measures, such as token-based validation and secure coding practices, to prevent similar vulnerabilities.
  • Restrict administrative access to the Cotonti installation to only trusted users and networks.
  • Monitor and audit administrative activities to detect potential exploitation attempts.
  • Use a Web Application Firewall (WAF) to detect and block suspicious traffic.
  • Educate administrators and users on the risks of phishing and social engineering attacks.
  • Regularly review and update Cotonti installations to ensure they are secure and up-to-date.

Evidence notes

The vulnerability was reported in the Cotonti 1.0.0 master branch, commit f43f1fc3. The system/admin/admin.rights.php file is vulnerable to CSRF attacks due to the lack of validation of the anti-CSRF token. The CVSS score for this vulnerability is 9.4, indicating a critical severity.

Official resources

public