CVE-2026-101093: Cotonti

Medium severity, CVSS 5.4. EPSS: 0.1% chance of exploitation in the next 30 days.

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated permissions by riding the administrator's session.

Affected products

• Cotonti Cotonti: up to and including 1.0.0

Published 2026-09-28. Last modified 2026-09-29.