CVE-2026-101093: fallo de gravedad media en Cotonti
Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion
Publicada el · Actualizada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.1%
probabilidad de explotación
0.1%top 98% de las CVE
explotación observada
noninguna fuente lo reporta
Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated permissions by riding the administrator's session.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Productos afectados
Cotonti · CotontiCVEs relacionadas — Cotonti
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-91939CRITICALCotonti 1.0.0 Comments Plugin PHP Object Injection via ci ParameterEPSS 1.0%CVE-2026-93868CRITICALCotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNGEPSS 0.7%CVE-2026-93872HIGHCotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb ParameterEPSS 0.7%CVE-2026-71294HIGHCotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit ActionsEPSS 0.4%CVE-2026-93869MEDIUMCotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() RegexEPSS 0.4%CVE-2026-55746HIGHCotonti stored XSS via PFS folder titleEPSS 0.3%
Referencias
https://github.com/Cotonti/Cotontihttps://github.com/Cotonti/Cotonti/blob/1.0.0/system/admin/admin.users.php#L136-L140https://github.com/Cotonti/Cotonti/issues/1907#issuecomment-5845691148https://github.com/Cotonti/Cotonti/pull/1908https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-via-user-group-deletion