{"id":"CVE-2026-101093","state":"PUBLISHED","title":"Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion","description":"Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated permissions by riding the administrator's session.","publishedAt":"2026-09-28T22:00:18.495Z","updatedAt":"2026-09-29T13:33:29.529Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Cotonti Cotonti"],"affected":[{"vendor":"Cotonti","product":"Cotonti","packageURL":"pkg:composer/cotonti/cotonti","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.0.0","versionType":"custom"}],"repo":"https://github.com/Cotonti/Cotonti","programFiles":["system/admin/admin.users.php"]}],"references":["https://github.com/Cotonti/Cotonti/issues/1907#issuecomment-5845691148","https://github.com/Cotonti/Cotonti/pull/1908","https://github.com/Cotonti/Cotonti/blob/1.0.0/system/admin/admin.users.php#L136-L140","https://github.com/Cotonti/Cotonti","https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-via-user-group-deletion"],"weaknesses":["CWE-352"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/101xxx/CVE-2026-101093.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-101093","state":"PUBLISHED","datePublished":"2026-09-28T22:00:18.495Z","dateUpdated":"2026-09-29T13:33:29.529Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-09-27T20:29:07.433Z"},"containers":{"cna":{"title":"Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion","descriptions":[{"lang":"en","value":"Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated permissions by riding the administrator's session."}],"affected":[{"vendor":"Cotonti","product":"Cotonti","packageURL":"pkg:composer/cotonti/cotonti","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.0.0","versionType":"custom"}],"repo":"https://github.com/Cotonti/Cotonti","programFiles":["system/admin/admin.users.php"]}],"references":[{"url":"https://github.com/Cotonti/Cotonti/issues/1907#issuecomment-5845691148","tags":["issue-tracking"]},{"url":"https://github.com/Cotonti/Cotonti/pull/1908","tags":["issue-tracking","patch"]},{"url":"https://github.com/Cotonti/Cotonti/blob/1.0.0/system/admin/admin.users.php#L136-L140","tags":["technical-description"]},{"url":"https://github.com/Cotonti/Cotonti","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-via-user-group-deletion","name":"VulnCheck Advisory: Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","lang":"en","description":"Cross-Site Request Forgery (CSRF)","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-09-28T22:00:18.495Z"},"datePublic":"2026-09-26T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cotonti:cotonti_siena:*:*:*:*:*:*:*:*","versionEndIncluding":"1.0.0"}]}]}],"credits":[{"lang":"en","value":"Harsh Raj Singhania","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-29T13:29:55.053578Z","id":"CVE-2026-101093","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-29T13:33:29.529Z"}}]}}}