CVE-2026-101093CWE-352csrf

CVE-2026-101093

Medium · published September 29, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
1.9
In the wild
Unconfirmed
What it is

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated permissions by riding the administrator's session.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00124 · 1.9th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-09-29T02:17Z
References (5)
https://github.com/Cotonti/Cotonti · [email protected]https://github.com/Cotonti/Cotonti/blob/1.0.0/system/admin/admin.users.php#L136-L140 · [email protected]https://github.com/Cotonti/Cotonti/issues/1907#issuecomment-5845691148 · [email protected]https://github.com/Cotonti/Cotonti/pull/1908 · [email protected]https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-via-user-group-deletion · [email protected]
EPSS history
Timeline
  • 30 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 28 SEP 22:00Z
    Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion
    cvelistv5