CVE-2026-55742: Cotonti 1.0.0 CSRF in Administration Rights Handler
CVE-2026-55742 is a Cross-Site Request Forgery flaw in the Cotonti CMS administration rights handler. The rights update action changes group access rights without validating the anti-CSRF token, so a logged-in administrator could be tricked into altering permissions. The CNA rates it critical, with a CVSS 3.1 score of 9.6.
Overview
CVE-2026-55742 is a Cross-Site Request Forgery (CSRF, CWE-352) vulnerability in Cotonti, an open-source PHP content management framework. According to the record, Cotonti 1.0.0 on the master branch at commit f43f1fc3 contains a rights update action in the administration rights handler (system/admin/admin.rights.php) that modifies group access rights, including through cot_auth_add_group, without calling cot_check_xg, the function that validates the anti-CSRF token. The relevant code location is referenced in the Cotonti repository.
Impact
The CNA assigned a CVSS 3.1 base score of 9.6 (critical) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, and a CVSS 4.0 score of 9.4. The attacker needs no privileges, but user interaction is required: an authenticated administrator must be lured into visiting attacker-controlled content while logged in. If that happens, the browser could submit a forged rights update, altering group permissions. Because access rights govern what every user group can do, an unauthorized change could grant broad privileges to accounts or groups the attacker controls, which explains the high confidentiality, integrity and availability ratings.
Affected products and versions
- Cotonti 1.0.0, master branch, commit f43f1fc3 (as stated in the description)
The record contains no structured list of affected version ranges and no fixed version. Other builds sharing the same rights handler code may also be affected, but this is not confirmed by the sources.
Exploitation status
The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record.
Remediation and mitigation
- Monitor the Cotonti GitHub repository for a commit or release that adds anti-CSRF token validation to the rights update action, and update once available.
- Administrators should avoid browsing untrusted sites in the same browser session used for Cotonti administration, and log out of the admin panel when not in use.
- Restrict access to the administration area (for example, by IP allowlisting or VPN) to reduce exposure.
- Where self-maintained forks are used, review state-changing admin actions to confirm they validate the anti-CSRF token before applying changes.
- Consider SameSite cookie attributes for session cookies as a defense-in-depth measure.
Detection guidance
- Review web server logs for rights update requests to the admin rights handler whose Referer header points to external domains or is missing unexpectedly.
- Periodically audit group permissions and compare them with an approved baseline; investigate unexpected privilege grants.
- Alert on changes to administrative or high-privilege group rights.
Limitations of the available information
The NVD status is Deferred. The record does not list affected version ranges, a patched version, or a fix commit, and contains no EPSS or SSVC data. Whether other Cotonti releases are affected is unknown. A missing fix in the record does not mean no fix exists; check the upstream project.
Frequently asked questions
What is CVE-2026-55742?
A Cross-Site Request Forgery flaw in Cotonti 1.0.0 where the admin rights update action changes group access rights without validating the anti-CSRF token via cot_check_xg.
Is CVE-2026-55742 being exploited?
It is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
Is there a fixed version?
The record does not list a fixed version or patch. Monitor the Cotonti GitHub repository for updates; meanwhile restrict admin access and avoid browsing untrusted sites while logged in as administrator.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.