CVE-2026-55742: Cotonti CMS CSRF Vulnerability

CVE-2026-55742 Overview

CVE-2026-55742 is a Cross-Site Request Forgery (CSRF) vulnerability in Cotonti 1.0.0 (master branch, commit f43f1fc3). The flaw resides in the administration rights handler at system/admin/admin.rights.php. The rights update action (a=update) modifies group access rights — including through cot_auth_add_group — without invoking cot_check_xg() to validate the anti-CSRF token. An attacker who lures an authenticated administrator to a malicious page can force the browser to submit a forged request that grants elevated permissions to an attacker-controlled group. The classification maps to [CWE-352].

Critical Impact
A single click by an authenticated administrator on attacker-controlled content can escalate a low-privileged group to administrator, enabling template modification and remote code execution.

Affected Products

Cotonti 1.0.0 (master branch, commit f43f1fc3)
system/admin/admin.rights.php rights update handler
Deployments exposing the Cotonti admin panel to authenticated administrators

Discovery Timeline

2026-06-18 - CVE-2026-55742 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-55742

Vulnerability Analysis

Cotonti enforces anti-CSRF protection through the cot_check_xg() helper, which validates a per-request token tied to the administrator session. The rights update action in admin.rights.php accepts the a=update parameter and applies privilege changes to one or more groups. The handler invokes cot_auth_add_group and related functions to commit those changes to the database. Because cot_check_xg() is never called along this code path, the server accepts state-changing requests that originate from any cross-origin context the administrator's browser can reach.

An attacker hosts an HTML page containing an auto-submitting form or image tag targeting the vulnerable endpoint. When an authenticated administrator visits the page, the browser attaches the existing session cookie and the server processes the forged rights update. The attacker can grant administrator-equivalent permissions to a group they control, then sign in as a member of that group. Because Cotonti administrators can edit templates and site configuration, this privilege escalation can be pivoted into PHP code execution on the underlying host.

Root Cause

The root cause is a missing authorization-state check on a state-changing request. Cotonti relies on a shared anti-CSRF token mechanism, but the rights update path omits the cot_check_xg() call that other administrative actions enforce. The handler treats a valid session cookie alone as sufficient authority to modify group rights, which violates synchronizer-token defenses for state-changing operations.

Attack Vector

Exploitation requires no credentials of the attacker's own. The attacker needs only to trick an authenticated administrator into loading a crafted page, link, or third-party content that issues a request to the Cotonti admin URL with parameters of the attacker's choosing. The forged request reuses the administrator's cookie, the server commits the rights change, and the attacker's group becomes privileged. See the GitHub Cotonti source code for the unchecked handler location.

No verified proof-of-concept code is published. The vulnerability mechanism is fully described in the Cotonti project repository referenced by the advisory.

Detection Methods for CVE-2026-55742

Indicators of Compromise

Web server access log entries showing POST or GET requests to admin.rights.php with a=update and a Referer header pointing to an external domain.
Unexpected modifications to the cot_auth table or equivalent rights storage, especially additions of administrator-level permissions to non-administrative groups.
New or modified Cotonti templates, plugin files, or configuration entries shortly after a rights change event.
Administrator session activity originating from one IP, immediately followed by privileged actions from a different IP using a newly elevated group.

Detection Strategies

Alert on requests to system/admin/admin.rights.php where the Referer or Origin header is absent or does not match the site's own host.
Correlate database audit events for cot_auth_add_group calls with the originating HTTP request and the user-agent string.
Baseline normal administrator workflows and flag rights changes that occur outside of expected administrative sessions.

Monitoring Recommendations

Enable verbose access logging on the Cotonti admin path and forward logs to a centralized analytics platform for retention and search.
Monitor file integrity on the themes/, plugins/, and system/ directories to catch follow-on template or code modifications.
Track group membership and rights table diffs on a scheduled cadence and alert on any unattended changes.

How to Mitigate CVE-2026-55742

Immediate Actions Required

Restrict access to the Cotonti administration interface using IP allow-listing or a VPN until a patched build is deployed.
Require administrators to log out of the Cotonti admin panel before browsing untrusted sites and to use a dedicated browser profile for administration.
Audit the rights and groups tables for unauthorized administrator grants and revoke any that cannot be attributed to a legitimate change.
Review templates, plugins, and configuration files for unauthorized PHP modifications introduced after suspicious rights changes.

Patch Information

No vendor patch reference is included in the advisory data. Track the Cotonti project repository for a fix to system/admin/admin.rights.php that adds a cot_check_xg() call to the a=update branch. Apply the upstream commit as soon as it is published and validate that all state-changing admin actions enforce token checks.

Workarounds

Add a local patch that calls cot_check_xg('rights') (or the project's canonical token name) at the top of the a=update branch in admin.rights.php before any rights mutation.
Place the admin panel behind HTTP Basic authentication or a reverse-proxy access control list to block unauthenticated cross-site requests from reaching the handler.
Configure the session cookie with SameSite=Strict so that cross-site requests do not carry administrator credentials.

bash

# Example nginx restriction limiting admin.rights.php to a trusted network
location = /system/admin/admin.rights.php {
    allow 10.0.0.0/24;
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}