Cotonti CVE-2026-55742

Exploitation requires (1) a target Cotonti 1.0.0 instance running the unpatched system/admin/admin.rights.php update handler, (2) an active authenticated administrator session in the victim's browser at the moment the malicious page is loaded, and (3) victim interaction in the form of visiting an attacker-controlled URL (UI:P in the CVSS 4.0 vector). Limiting factors: the attacker must know or guess the target site's admin URL and the parameter names consumed by the 'a=update' action, the admin must currently be logged in with a valid session cookie, and any deployment that already sets SameSite=Strict on the session cookie, fronts the admin panel with IP allowlisting, or has manually added cot_check_xg() to this handler will not be exploitable.

The CVSS 4.0 base score of 9.4 is driven by AV:N, AC:L, PR:N, UI:P with full vulnerable- and subsequent-system C/I/A impact, which is consistent with the description: the attacker themselves is unauthenticated, but the victim (an administrator) must passively visit a malicious page, captured by UI:P. EPSS, KEV, and SSVC signals are not provided in the input; the CVE is not on CISA KEV and no public exploit code is referenced, so realistic exploitation today is conditioned on luring a specific privileged user rather than mass-scanning. The high score is justified because a successful single CSRF chains directly into administrator privileges and, via template editing, to RCE - meaning low likelihood per attempt is offset by very high impact per success. Note the conflicting signal worth flagging: PR:N reflects the attacker, not the action, while the request itself requires an admin session in the victim's browser, so operators should reason about admin browsing hygiene, not raw network exposure.

An attacker hosts a page containing an auto-submitting HTML form (or an image tag for a GET variant) targeting /system/admin/admin.rights.php?a=update with parameters that add an attacker-controlled group to the administrator rights set, and lures a logged-in Cotonti administrator to it via a phishing email, forum link, or watering-hole comment. The victim's browser silently submits the request with their session cookie, the server grants admin rights to the attacker's account, and the attacker then logs in and edits a Cotonti template to inject PHP, achieving remote code execution on the host.