CVE-2026-101093: Cotonti CMS CSRF Vulnerability

CVE-2026-101093 Overview

Cotonti through version 1.0.0 contains a cross-site request forgery (CSRF) vulnerability in admin.users.php. The flaw allows attackers to delete user groups and their associated permissions without token verification. An attacker crafts a malicious link or page that, when visited by an authenticated administrator, rides the administrator's active session to issue the deletion request.

The vulnerability is classified under CWE-352: Cross-Site Request Forgery. Successful exploitation requires user interaction from a privileged administrator but no attacker authentication.

Critical Impact
Attackers can silently delete custom user groups and their permission mappings on any Cotonti site up to version 1.0.0 by tricking an authenticated administrator into loading attacker-controlled content.

Affected Products

Cotonti Content Management System through version 1.0.0
Component: system/admin/admin.users.php (user group deletion handler)
Deployments exposing the Cotonti admin interface to authenticated administrator sessions

Discovery Timeline

2026-09-28 - CVE-2026-101093 published to the National Vulnerability Database
2026-09-29 - Entry last modified in NVD

Technical Details for CVE-2026-101093

Vulnerability Analysis

Cotonti is an open source PHP content management system. The administrative interface exposes group management functionality inside admin.users.php. According to the vulnerable code snippet, the group deletion branch executes state-changing database operations based solely on request parameters supplied to the endpoint.

The handler does not validate an anti-CSRF token before deleting the target group and its permission rows. Because the browser automatically attaches the administrator's session cookie, a cross-origin request from an attacker-controlled page reaches the endpoint with full administrative authority.

An attacker can weaponize the flaw with a single hyperlink, an inline image, or an auto-submitting form hosted on an unrelated site. The referenced GitHub issue thread and the corresponding pull request #1908 confirm the missing token check and the proposed fix.

Root Cause

The root cause is missing origin and token validation on a state-changing administrative action. Cotonti processes the group deletion request without verifying a per-session xg (anti-CSRF) token, without checking the HTTP Origin or Referer headers, and without requiring a re-authentication step.

Attack Vector

Exploitation is remote and requires the victim to be an authenticated Cotonti administrator with an active session. The attacker delivers a crafted URL through phishing, forum posts, chat messages, or a compromised third-party site. When the administrator loads the attacker-controlled resource, the browser issues the group deletion request under the administrator's session context, and the affected group and its permissions are removed. Impact is limited to integrity and availability of authorization data; user credentials and content are not directly disclosed.

Detection Methods for CVE-2026-101093

Indicators of Compromise

Unexpected removal of custom user groups or permission rows from the Cotonti database tables backing group configuration.
HTTP access log entries pointing to admin.users.php with a group deletion action where the Referer header is absent or points to an external domain.
Administrator session activity originating from pages the administrator did not intend to visit, correlated with group changes in the audit log.

Detection Strategies

Review web server logs for requests to admin/admin.users.php that carry deletion parameters and lack a same-origin Referer.
Alert on any group deletion event outside of maintenance windows or performed by accounts that do not normally administer groups.
Baseline the set of Cotonti user groups and monitor the backing tables for row deletions using database triggers or file integrity monitoring on periodic exports.

Monitoring Recommendations

Enable and centralize Cotonti application logs alongside web server access logs in a SIEM for correlation.
Instrument alerts for administrator sessions performing sensitive actions immediately after loading external referers.
Track outbound clicks from administrator webmail and messaging clients that land on the Cotonti admin path.

How to Mitigate CVE-2026-101093

Immediate Actions Required

Apply the upstream fix delivered through Cotonti pull request #1908 or upgrade to a release that includes it once published.
Restrict access to the Cotonti admin interface by IP allowlist, VPN, or reverse-proxy authentication until the patch is deployed.
Instruct administrators to log out of Cotonti when not actively managing the site and to avoid clicking untrusted links while authenticated.

Patch Information

The maintainers proposed a fix in pull request #1908 in the Cotonti repository, adding token verification to the group deletion path in admin.users.php. See the VulnCheck advisory for advisory metadata and remediation status.

Workarounds

Deploy a web application firewall rule that blocks requests to admin.users.php deletion actions when the Referer or Origin header is not the Cotonti site itself.
Set session cookies to SameSite=Strict at the reverse proxy or PHP configuration layer to block cross-site cookie attachment on administrative requests.
Use a dedicated browser profile for Cotonti administration and clear the session immediately after use to shrink the exploitation window.

bash

# Example nginx snippet: reject cross-origin POSTs to the Cotonti admin endpoint
location /admin/admin.users.php {
    if ($request_method = POST) {
        set $csrf_block "1";
    }
    if ($http_origin ~* "^https://cotonti\.example\.com$") {
        set $csrf_block "0";
    }
    if ($csrf_block = "1") {
        return 403;
    }
}