Cotonti EUVD-2026-88561

Exploitation requires a Cotonti (through 1.0.0) administrator to be authenticated with an active session AND to be tricked into visiting an attacker-controlled page or clicking a malicious link (UI:P) while that session is valid. The specific vulnerable action is the user-group deletion handler in system/admin/admin.users.php, which omits the anti-CSRF (xg/token) verification that the vendor's PR #1908 adds elsewhere. There are no authentication prerequisites for the attacker themselves (PR:N), but the attack cannot succeed without the victim admin's live session and interaction, which meaningfully limits opportunistic exploitation.

This is a genuine but low-to-moderate priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) reflects a classic CSRF pattern: the attacker needs no privileges of their own (PR:N) but the attack rides an authenticated administrator's session and requires that admin to interact with attacker-controlled content (UI:P), which is a meaningful limiting factor. Impact is scoped to integrity and availability of authorization data (VC:N/VI:L/VA:L) - deleting custom user groups and their permissions - with no confidentiality exposure and no scope change, consistent with the 5.3 score. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or automated exploitation; the SSVC framework is not supplied either. The vulnerability is confirmed by the source and a fix exists, but the reliance on tricking a logged-in admin and the destructive-only (not RCE/data-theft) impact keep real-world risk modest. No conflicting signals were found: the description (admin session riding) matches the CVSS vector (PR:N + UI:P) accurately.

An attacker crafts a malicious web page or link that issues a forged request to admin.users.php's group-deletion endpoint and lures a logged-in Cotonti administrator into visiting it. Because the deletion action lacks anti-CSRF token verification, the admin's browser silently submits the request using their active session, deleting a custom user group and its associated permissions. No public exploit code was identified at time of analysis, but the technique is trivial to construct.