CVE-2026-101093 — Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion
Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers ca…
Published: 2026-09-28 · CVSS: 5.3 · CVSS 4.0
Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated permissions by riding the administrator's session.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7