Which versions of Cotonti are affected by EUVD-2026-37854?

A critical vulnerability in Cotonti 1.0.0 allows remote attackers to compromise administrator accounts through social engineering attacks, bypassing authentication protections.

How to fix or mitigate EUVD-2026-37854?

Within 24 hours: Inventory all Cotonti 1.0.0 deployments and notify administrators to be vigilant against suspicious requests to confirm administrative privileges. Within 7 days: Audit administrative action logs for unauthorized privilege changes, template modifications, or configuration updates since installation. Within 30 days: Pursue vendor contact to obtain security patches or evaluate alternative content management platforms if Cotonti development team cannot provide timely remediation.

Cotonti EUVD-2026-37854

Q: What is the CVSS score of EUVD-2026-37854?

EUVD-2026-37854 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-55742 CRITICAL

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-18 TuranSec

GHSA-7g3p-35vc-mgjr

PHP RCE CSRF Cotonti

9.4

CVSS 4.0 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Attacker is unauthenticated (PR:N) but needs victim admin to click (UI:R); forged request crosses trust boundary into admin context (S:C) with full C/I/A impact via template-driven RCE.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jun 18, 2026 - 08:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 18, 2026 - 08:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 18, 2026 - 08:37 vuln.today

cvss_changed

CVSS changed

Jun 18, 2026 - 08:37 NVD

9.6 (CRITICAL) 9.4 (CRITICAL)

Analysis Generated

Jun 18, 2026 - 08:00 vuln.today

DescriptionCVE.org

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated administrator into visiting a malicious page can force the browser to submit a forged request that grants elevated permissions to an attacker-controlled group, escalating privileges to administrator. Because Cotonti administrators can modify templates and configuration, this can be further leveraged toward remote code execution.

Articles & Coverage 1

News Critical CSRF Privilege Escalation in PHP Cotonti 1.0.0 - CVE-2026-55742 Jun 19, 2026

AnalysisAI

Cross-site request forgery in Cotonti 1.0.0 (commit f43f1fc3) lets a remote attacker escalate privileges to administrator by tricking a logged-in admin into loading an attacker-controlled page that submits a forged rights-update request to system/admin/admin.rights.php. Because Cotonti administrators can edit templates and configuration, the resulting account can be pivoted to remote code execution on the host. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Cotonti is an open-source PHP content management framework that exposes a per-group access-rights editor at system/admin/admin.rights.php. The application ships an anti-CSRF helper, cot_check_xg(), that validates a per-session token (the 'xg' parameter) before sensitive state changes; however, the 'a=update' branch in admin.rights.php invokes cot_auth_add_group() and the surrounding rights-mutation logic without first calling cot_check_xg(). This is a textbook CWE-352 (Cross-Site Request Forgery) instance: the server trusts the authenticated session cookie alone, so any cross-origin form or image-tag triggered request the browser submits while the admin is logged in is treated as a legitimate administrative action. The affected component is identified by CPE cpe:2.3:a:cotonti:cotonti:*:*:*:*:*:*:*:* and the vulnerable source line is referenced upstream at github.com/Cotonti/Cotonti commit f43f1fc3.

RemediationAI

No vendor-released patch identified at time of analysis; operators should monitor https://github.com/Cotonti/Cotonti for an upstream commit that adds a cot_check_xg() call (or equivalent xg-token validation) to the 'a=update' branch of system/admin/admin.rights.php and apply it as soon as it is tagged. As an interim fix, site maintainers can locally patch admin.rights.php to invoke cot_check_xg() at the top of the update action and reject requests lacking a valid xg token, which directly closes the root cause with minimal side effects beyond breaking any external tooling that posts to that endpoint without a token. Compensating controls until a patch lands include restricting access to /system/admin/* at the web-server or WAF layer to known administrator source IPs (side effect: breaks legitimate admin access from other networks), requiring administrators to use a dedicated browser profile or container for Cotonti administration so attacker-controlled tabs cannot share the session cookie, and setting the session cookie's SameSite attribute to Strict in PHP configuration (side effect: may log admins out when arriving from external links).