---
id: CVE-2026-101093
title: >-
  Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in
  admin.users.php that allows attackers to delete user groups without token
  verification
summary: >-
  Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in
  admin.users.php that allows attackers to delete user groups without token
  verification. Attackers can craft malicious links or pages that trick
  authenticated ad…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L'
cwe:
  - CWE-352
vendor: Cotonti
product: Cotonti
affected:
  - Cotonti <= 1.0.0
published: '2026-09-28'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T14:17:18.687'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101093'
references:
  - url: 'https://github.com/Cotonti/Cotonti'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Cotonti/Cotonti/blob/1.0.0/system/admin/admin.users.php#L136-L140
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Cotonti/Cotonti/issues/1907#issuecomment-5845691148'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Cotonti/Cotonti/pull/1908'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/cotonti-through-1.0.0-cross-site-request-forgery-via-user-group-deletion
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-29T13:29:55.053578Z'
epss: 0.00124
epssPercentile: 0.02114
ingestedAt: '2026-09-28T22:22:13.608Z'
---

## Overview

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated permissions by riding the administrator's session.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.